Splunk Search

Can I run another search based on the results of a previous search?

mbenitezr
Explorer

Hi

I want to search the command "kill" on source bash_command=kill* and search the process from sourcetype=ps

Thanks a lot.

Tags (2)
0 Karma
1 Solution

masonmorales
Influencer

Yes, you would use a subsearch. The subsearch is evaluated first, and is treated as a boolean AND to your base search.

Example:

sourcetype=ps [search bash_command=kill* | fields ps]

View solution in original post

bandit
Motivator

Note: the the subsearch (child search) will append PID=### to the primary (parent search) where ### is the PID digits. If the parent search does not know what the field PID is, it won't work. I made some minor tweaks to the regex. Also typesource should be "sourcetype".

sourcetype=ps [ search bash_command=kill* | rex field=bash_command "kill\s+(?<PID>\d+)" | dedup PID | fields PID ]

you could do a manual test of the primary search by hard coding the PID you are looking for as a test. If the manual test doesn't work, then the dynamic sub search won't work.

i.e.

sourcetype=ps PID="###"

Alternate search which will just search for the PID as a string instead of as a field. Might result in false positive matches.

sourcetype=ps [ search bash_command=kill* | rex field=bash_command "kill\s+(?<PID>\d+)" | dedup PID | fields PID | rename PID as search ]

More or less equivalent to a manual search of

sourcetype=ps "###"

mbenitezr
Explorer

thanks a lot

0 Karma

mbenitezr
Explorer

hello again,

I have this:

(sourcetype=ps) | search [search bash_command=kill* | rex field=bash_command "kill (?.+[0-9])" | dedup PID |fields PID ]

But don't work, i now i need split PID, but, i want first somo data

thanks a lot to rob_jordan and masonmorales

0 Karma

masonmorales
Influencer

Glad it worked out. Could you click "Accept Answer" please?

0 Karma

mbenitezr
Explorer

it is not working well, i want to search the process was killed in typesouce ps, but i can't do it

0 Karma

masonmorales
Influencer

Could you post sample data from each source please?

0 Karma

masonmorales
Influencer

Yes, you would use a subsearch. The subsearch is evaluated first, and is treated as a boolean AND to your base search.

Example:

sourcetype=ps [search bash_command=kill* | fields ps]

mbenitezr
Explorer

you just have change typesource for sourcetype

0 Karma

masonmorales
Influencer

Yes, sorry, I thought "typesource" was a field extraction that you had. If your sourcetype is called "ps" then it is "sourcetype=ps [search bash_command=kill* | fields ps]"

My apologies for any confusion that may have caused.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...