Splunk Search

Help for subsearch

nebel
Communicator

Hi Splunkers,

I need the result from first search in another search.

First search:
sourcetype=win_server | multikv fields ID Servername | search Servername=$INPUT$ | table ID | dedup ID

--> gives me for exmaple ID 13 back

At next I need this ID for figure out the location

Secound search:

sourcetype=win_server | multikv fields ID Location | search ID=$INPUT$ | table Location | dedup Location

Can anyone help me to bring them together?

Thanks a lot

Cheers

Tags (1)
0 Karma
1 Solution

MHibbin
Influencer

I think you will need to use the subsearch (docs) field, "search" (shown in the subsearch docs), you should then be able to modify your search to the following:

sourcetype=win_server | multikv fields ID Location | search [search sourcetype=win_server | multikv fields ID Servername | search Servername=$INPUT$ | table ID | dedup ID | rename ID as search | fields + search] | table Location | dedup Location

Basically this should be equivalent to you typing ".. | search ID=13 |.." if you were to search the data manually. (additionally... the "query" performs a more generic search, i.e. "... | search 13 | ...").

Regards,

MHibbin

View solution in original post

MHibbin
Influencer

I think you will need to use the subsearch (docs) field, "search" (shown in the subsearch docs), you should then be able to modify your search to the following:

sourcetype=win_server | multikv fields ID Location | search [search sourcetype=win_server | multikv fields ID Servername | search Servername=$INPUT$ | table ID | dedup ID | rename ID as search | fields + search] | table Location | dedup Location

Basically this should be equivalent to you typing ".. | search ID=13 |.." if you were to search the data manually. (additionally... the "query" performs a more generic search, i.e. "... | search 13 | ...").

Regards,

MHibbin

MHibbin
Influencer

nice one, have fun!

0 Karma

nebel
Communicator

thanks a lot. Worked great!

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...