Splunk Search

Eval Command?

tmarlette
Motivator

I am attempting to look for the top 10 offenders of a specific event type, and get their IP address. That I can do no problem.

I then need to take those 10 IP addresses (I was thinking eval or a subsearch?) and search for another specific event type to return the user information.

This is the string I am using to return the IP:

sourcetype=mysource tag=reco WBF2254 | rex r=(?<IP>\d+.\d+.\d+.\d+:\d+) | top IP limit=10 

Can I pipe this to eval or another search or does this have to be manual?

Thanks Guys!

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Actually this is very similar to the examples in the docs about how you can use subsearches. 🙂

http://docs.splunk.com/Documentation/Splunk/latest/User/HowSubsearchesWork

Use the subsearch for grabbing the top 10 IP's, then return those to the outer search. You don't specify what the search for finding the additional information for each IP looks like, so I won't be able to include that in my suggestion, but the search + subsearch would probably begin like this:

<outer search condition> [search sourcetype=mysource tag=reco WBF2254 | rex r=(?<IP>\d+.\d+.\d+.\d+:\d+) | top IP limit=10 | fields IP]

View solution in original post

Ayn
Legend

Actually this is very similar to the examples in the docs about how you can use subsearches. 🙂

http://docs.splunk.com/Documentation/Splunk/latest/User/HowSubsearchesWork

Use the subsearch for grabbing the top 10 IP's, then return those to the outer search. You don't specify what the search for finding the additional information for each IP looks like, so I won't be able to include that in my suggestion, but the search + subsearch would probably begin like this:

<outer search condition> [search sourcetype=mysource tag=reco WBF2254 | rex r=(?<IP>\d+.\d+.\d+.\d+:\d+) | top IP limit=10 | fields IP]

Ayn
Legend

No problem. 🙂

You would have to recalculate the count if you want that in your final stats, so just add | stats count by IP at the end to get something like that.

0 Karma

tmarlette
Motivator

Thank you Ayn!! I'm relatively new at Splunk if you couldn't tell. 😃

Do you know how to return the count of the sub search instead of the primary search?

0 Karma

tmarlette
Motivator

I'm attempting to use the "return" command through a sub search, but I don't know if i'm on the right track.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...