Can I run another search based on the results of a previous search?

[mbenitezr]

Hi

I want to search the command "kill" on source bash_command=kill* and search the process from sourcetype=ps

Thanks a lot.

[bandit]

Note: the the subsearch (child search) will append PID=### to the primary (parent search) where ### is the PID digits. If the parent search does not know what the field PID is, it won't work. I made some minor tweaks to the regex. Also typesource should be "sourcetype".

sourcetype=ps [ search bash_command=kill* | rex field=bash_command "kill\s+(?<PID>\d+)" | dedup PID | fields PID ]

you could do a manual test of the primary search by hard coding the PID you are looking for as a test. If the manual test doesn't work, then the dynamic sub search won't work.

i.e.

sourcetype=ps PID="###"

Alternate search which will just search for the PID as a string instead of as a field. Might result in false positive matches.

sourcetype=ps [ search bash_command=kill* | rex field=bash_command "kill\s+(?<PID>\d+)" | dedup PID | fields PID | rename PID as search ]

More or less equivalent to a manual search of

sourcetype=ps "###"

[mbenitezr]

thanks a lot

[mbenitezr]

hello again,

I have this:

(sourcetype=ps) | search [search bash_command=kill* | rex field=bash_command "kill (?.+[0-9])" | dedup PID |fields PID ]

But don't work, i now i need split PID, but, i want first somo data

thanks a lot to rob_jordan and masonmorales

[masonmorales]

Glad it worked out. Could you click "Accept Answer" please?

[mbenitezr]

it is not working well, i want to search the process was killed in typesouce ps, but i can't do it

[masonmorales]

Could you post sample data from each source please?

[masonmorales · Accepted solution]

Yes, you would use a subsearch. The subsearch is evaluated first, and is treated as a boolean AND to your base search.

Example:

sourcetype=ps [search bash_command=kill* | fields ps]

[mbenitezr]

you just have change typesource for sourcetype

[masonmorales]

Yes, sorry, I thought "typesource" was a field extraction that you had. If your sourcetype is called "ps" then it is "sourcetype=ps [search bash_command=kill* | fields ps]"

My apologies for any confusion that may have caused.

[bandit]

I think this post may help you.

http://answers.splunk.com/answers/89845/filter-search-results-based-on-return-value-of-subsearch.htm...