How can I use the results from search 1 in search 2?

[brandonpal]

Hi,

We are using VSFTP and I have two logs: xferlog and vsftp.log.

In my xferlog we have FTPUser & client and in vsftp.log I have client. Client = Client IP in both logs.

I need to run a search from my xferlog based on FTPUser to figure out IP's. I then need to run a search based on those IP addresses.

I'm trying to see if we are seeing errors in our vsftp.log when the user is trying to download files.

To get the IP I'm currently using this:

index=ftp FTPUser="test" sourcetype=vsftpd | stats values(client) by FTPUser

To then run a search based on that IP I'm using this:

index=ftp sourcetype=vsftpd_accessLog client="162.X.X.X"

Any help is greatly appreciated.

[somesoni2 · Accepted solution]

Try this

index=ftp sourcetype=vsftpd_accessLog [search index=ftp FTPUser="test" sourcetype=vsftpd | stats count by client | fields - count]

This should give you all vsftpd_accessLog entries for client (client IP) used by user test

[yannK]

What about using the results of a sub search as a search condition for the main search.

see http://docs.splunk.com/Documentation/Splunk/6.1.3/Search/Usesubsearchtocorrelateevents

example:


index=ftp sourcetype=vsftpd_accessLog [ search index=ftp FTPUser="test" sourcetype=vsftpd | stats count by client | table client ]


The sub search return the list of "client" field, they will be converted to client=A OR client=B OR client=C etc....
Remark : the sub search are limited to 10000 lines of result, so only the first 10000 ips.