Help for subsearch

[nebel]

Hi Splunkers,

I need the result from first search in another search.

First search:
sourcetype=win_server | multikv fields ID Servername | search Servername=$INPUT$ | table ID | dedup ID

--> gives me for exmaple ID 13 back

At next I need this ID for figure out the location

Secound search:

sourcetype=win_server | multikv fields ID Location | search ID=$INPUT$ | table Location | dedup Location

Can anyone help me to bring them together?

Thanks a lot

Cheers

[MHibbin · Accepted solution]

I think you will need to use the subsearch (docs) field, "search" (shown in the subsearch docs), you should then be able to modify your search to the following:

sourcetype=win_server | multikv fields ID Location | search [search sourcetype=win_server | multikv fields ID Servername | search Servername=$INPUT$ | table ID | dedup ID | rename ID as search | fields + search] | table Location | dedup Location

Basically this should be equivalent to you typing ".. | search ID=13 |.." if you were to search the data manually. (additionally... the "query" performs a more generic search, i.e. "... | search 13 | ...").

Regards,

MHibbin

[MHibbin]

nice one, have fun!

[nebel]

thanks a lot. Worked great!