Splunk Search

How can I use the results from search 1 in search 2?

brandonpal
Explorer

Hi,

We are using VSFTP and I have two logs: xferlog and vsftp.log.

In my xferlog we have FTPUser & client and in vsftp.log I have client. Client = Client IP in both logs.

I need to run a search from my xferlog based on FTPUser to figure out IP's. I then need to run a search based on those IP addresses.

I'm trying to see if we are seeing errors in our vsftp.log when the user is trying to download files.

To get the IP I'm currently using this:

index=ftp FTPUser="test" sourcetype=vsftpd | stats values(client) by FTPUser

To then run a search based on that IP I'm using this:

index=ftp sourcetype=vsftpd_accessLog client="162.X.X.X"

Any help is greatly appreciated.

Tags (3)
1 Solution

somesoni2
Revered Legend

Try this

index=ftp sourcetype=vsftpd_accessLog [search index=ftp FTPUser="test" sourcetype=vsftpd | stats count by client | fields - count]

This should give you all vsftpd_accessLog entries for client (client IP) used by user test

View solution in original post

somesoni2
Revered Legend

Try this

index=ftp sourcetype=vsftpd_accessLog [search index=ftp FTPUser="test" sourcetype=vsftpd | stats count by client | fields - count]

This should give you all vsftpd_accessLog entries for client (client IP) used by user test

View solution in original post

yannK
Splunk Employee
Splunk Employee

What about using the results of a sub search as a search condition for the main search.

see http://docs.splunk.com/Documentation/Splunk/6.1.3/Search/Usesubsearchtocorrelateevents

example:


index=ftp sourcetype=vsftpd_accessLog [ search index=ftp FTPUser="test" sourcetype=vsftpd | stats count by client | table client ]

The sub search return the list of "client" field, they will be converted to client=A OR client=B OR client=C etc....
Remark : the sub search are limited to 10000 lines of result, so only the first 10000 ips.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!