Splunk Search

Help for subsearch

nebel
Communicator

Hi Splunkers,

I need the result from first search in another search.

First search:
sourcetype=win_server | multikv fields ID Servername | search Servername=$INPUT$ | table ID | dedup ID

--> gives me for exmaple ID 13 back

At next I need this ID for figure out the location

Secound search:

sourcetype=win_server | multikv fields ID Location | search ID=$INPUT$ | table Location | dedup Location

Can anyone help me to bring them together?

Thanks a lot

Cheers

Tags (1)
0 Karma
1 Solution

MHibbin
Influencer

I think you will need to use the subsearch (docs) field, "search" (shown in the subsearch docs), you should then be able to modify your search to the following:

sourcetype=win_server | multikv fields ID Location | search [search sourcetype=win_server | multikv fields ID Servername | search Servername=$INPUT$ | table ID | dedup ID | rename ID as search | fields + search] | table Location | dedup Location

Basically this should be equivalent to you typing ".. | search ID=13 |.." if you were to search the data manually. (additionally... the "query" performs a more generic search, i.e. "... | search 13 | ...").

Regards,

MHibbin

View solution in original post

MHibbin
Influencer

I think you will need to use the subsearch (docs) field, "search" (shown in the subsearch docs), you should then be able to modify your search to the following:

sourcetype=win_server | multikv fields ID Location | search [search sourcetype=win_server | multikv fields ID Servername | search Servername=$INPUT$ | table ID | dedup ID | rename ID as search | fields + search] | table Location | dedup Location

Basically this should be equivalent to you typing ".. | search ID=13 |.." if you were to search the data manually. (additionally... the "query" performs a more generic search, i.e. "... | search 13 | ...").

Regards,

MHibbin

MHibbin
Influencer

nice one, have fun!

0 Karma

nebel
Communicator

thanks a lot. Worked great!

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...