Splunk Search
Highlighted

Eval Command?

Motivator

I am attempting to look for the top 10 offenders of a specific event type, and get their IP address. That I can do no problem.

I then need to take those 10 IP addresses (I was thinking eval or a subsearch?) and search for another specific event type to return the user information.

This is the string I am using to return the IP:

sourcetype=mysource tag=reco WBF2254 | rex r=(?<IP>\d+.\d+.\d+.\d+:\d+) | top IP limit=10 

Can I pipe this to eval or another search or does this have to be manual?

Thanks Guys!

Tags (2)
0 Karma
Highlighted

Re: Eval Command?

Motivator

I'm attempting to use the "return" command through a sub search, but I don't know if i'm on the right track.

0 Karma
Highlighted

Re: Eval Command?

Legend

Actually this is very similar to the examples in the docs about how you can use subsearches. 🙂

http://docs.splunk.com/Documentation/Splunk/latest/User/HowSubsearchesWork

Use the subsearch for grabbing the top 10 IP's, then return those to the outer search. You don't specify what the search for finding the additional information for each IP looks like, so I won't be able to include that in my suggestion, but the search + subsearch would probably begin like this:

<outer search condition> [search sourcetype=mysource tag=reco WBF2254 | rex r=(?<IP>\d+.\d+.\d+.\d+:\d+) | top IP limit=10 | fields IP]

View solution in original post

Highlighted

Re: Eval Command?

Motivator

Thank you Ayn!! I'm relatively new at Splunk if you couldn't tell. 😃

Do you know how to return the count of the sub search instead of the primary search?

0 Karma
Highlighted

Re: Eval Command?

Legend

No problem. 🙂

You would have to recalculate the count if you want that in your final stats, so just add | stats count by IP at the end to get something like that.

0 Karma