Splunk Search

Doing lookup in the same index without using lookup command

thambisetty
SplunkTrust
SplunkTrust

Hi
[index=main host=syslog status="deny"| top src_IP | table src_IP ]:::::this is my sub search.
and it will produce top 10 src_IPs like below.
10.0.0.0

10.0.0.1
10.0.0.2
10.0.0.3
10.0.0.4
10.0.0.5
10.0.0.6
10.0.0.7
10.0.0.8
10.0.0.9
Now I want to check the status where status="start" OR status="accept" for the above src_IPs in the same index and host.

Please help me in this..
Thanks in advance.

————————————
If this helps, give a like below.
Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index=main host=syslog status="start" OR status="accept" [search index=main host=syslog status="deny"| top src_IP | table src_IP | format "" "" "" "" "OR" ""]

View solution in original post

somesoni2
Revered Legend

Try this

index=main host=syslog status="start" OR status="accept" [search index=main host=syslog status="deny"| top src_IP | table src_IP | format "" "" "" "" "OR" ""]

thambisetty
SplunkTrust
SplunkTrust

Thank u soooo much. it worked.

————————————
If this helps, give a like below.
0 Karma

somesoni2
Revered Legend

This will create a consolidated single statement from results of subsearch (something like src_IP=value1 OR src_IP=value2...etc. Ideally previous version of the search should've worked but something adding format does the trick.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Thanks.
Im not in office.
may I know why that format..

————————————
If this helps, give a like below.
0 Karma

somesoni2
Revered Legend

Try the updated one.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Thanks for ur immediate response.
I tried that one but it is showing different src_IPs. The src_IPs not at all related to result of sub search.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...