Splunk Search

How can I search for a file and then use the name of that file to drive the next search?

dmoulais
New Member

I have a collection of hundreds of files. I want to write a search that (1) finds which file has a certain keyword and then (2) search that particular file for additional content for tabling.

Searching for the specific file is done as follows ...

source="jobs/*" "load = 1234" | dedup source

... but I have been googling/trying to figure out how to use that source to drive the next part of the query. Here is some pseudocode with source renamed for ?clarity? as so far I have not been able to find a good way.

source="jobs/*" "load = 1234" | dedup source | rename source as XX | search source=XX "mysearchstring"

Tags (1)
0 Karma

teunlaan
Contributor

Think you want to use a subsearch:

"mysearchstring" [ search source="jobs/*" "load = 1234" | dedup source | table source ] 

SubSearch doc

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...