Splunk Search

Can I run a query on my results from a previous query?

koocies
Path Finder

or do I have to run a whole new query?

0 Karma

memarshall63
Communicator

Not much to go on here... Maybe you can provide some more details around what you've tried and what your current data set or query attempts are...

Broadly you can look at these:

https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Search
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Where
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchTutorial/Useasubsearch

0 Karma

koocies
Path Finder

If I run a query I get results, then I look over my results. Sometimes I want to filter out certain things from my results. I'd rather filter out my results and to research the index. I don't need to go back to well, I've got what I need, but I just need to filter out a little.

0 Karma

memarshall63
Communicator

You're looking for a way to persist some search results -- and then further filter them?

There's a few mechanisms for that with Splunk.
I think one is the closest to what you're looking for:
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Loadjob
See also:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Usesummaryindexing

There's likely a few others that also would help.
Good luck.

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...