Splunk Search

Can I run a query on my results from a previous query?

koocies
Path Finder

or do I have to run a whole new query?

0 Karma

memarshall63
Communicator

Not much to go on here... Maybe you can provide some more details around what you've tried and what your current data set or query attempts are...

Broadly you can look at these:

https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Search
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Where
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchTutorial/Useasubsearch

0 Karma

koocies
Path Finder

If I run a query I get results, then I look over my results. Sometimes I want to filter out certain things from my results. I'd rather filter out my results and to research the index. I don't need to go back to well, I've got what I need, but I just need to filter out a little.

0 Karma

memarshall63
Communicator

You're looking for a way to persist some search results -- and then further filter them?

There's a few mechanisms for that with Splunk.
I think one is the closest to what you're looking for:
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Loadjob
See also:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Usesummaryindexing

There's likely a few others that also would help.
Good luck.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...