Eval Command?

[tmarlette]

I am attempting to look for the top 10 offenders of a specific event type, and get their IP address. That I can do no problem.

I then need to take those 10 IP addresses (I was thinking eval or a subsearch?) and search for another specific event type to return the user information.

This is the string I am using to return the IP:

sourcetype=mysource tag=reco WBF2254 | rex r=(?<IP>\d+.\d+.\d+.\d+:\d+) | top IP limit=10 

Can I pipe this to eval or another search or does this have to be manual?

Thanks Guys!

[Ayn · Accepted solution]

Actually this is very similar to the examples in the docs about how you can use subsearches. 🙂

http://docs.splunk.com/Documentation/Splunk/latest/User/HowSubsearchesWork

Use the subsearch for grabbing the top 10 IP's, then return those to the outer search. You don't specify what the search for finding the additional information for each IP looks like, so I won't be able to include that in my suggestion, but the search + subsearch would probably begin like this:

<outer search condition> [search sourcetype=mysource tag=reco WBF2254 | rex r=(?<IP>\d+.\d+.\d+.\d+:\d+) | top IP limit=10 | fields IP]

[Ayn]

No problem. 🙂

You would have to recalculate the count if you want that in your final stats, so just add | stats count by IP at the end to get something like that.

[tmarlette]

Thank you Ayn!! I'm relatively new at Splunk if you couldn't tell. 😃

Do you know how to return the count of the sub search instead of the primary search?

[tmarlette]

I'm attempting to use the "return" command through a sub search, but I don't know if i'm on the right track.