How do I pull data from a subsearch?

[user12345a_2]

So I have the following search:
search host="MY_IP_LIST" index="test" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"| table src_ip
which generates a list of IPs for which I need to search for username's against.

Normally, for a single IP (e.g. 192.168.0.1) I can run:
sourcetype=WinEventLog* 192.168.0.1 "EventCode=4624" | table src_ip, user|dedup src_ip, user
and I get a list of users that have logged into that system.

How do I use the results of the IP list from my first search to generate a table with IPs and usernames? I've been trying subsearches but to-date I've been unsuccessful.

Thank you in advance for the help.

[twinspop]

You really need to know the field name for the IP in the second search. The single field output from the first search needs to match that. Assuming you have a field named src_ip in the second set of logs:

[ search host="MY_IP_LIST" index="test" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"
    | table src_ip
] sourcetype=WinEventLog* "EventCode=4624" 
| table src_ip, user
| dedup src_ip, user

This will essentially create a list of (src_ip=something OR src_ip=somethingelse ....) representing all your src_ips and insert that into your search string.

[gokadroid]

Can you try this below:

sourcetype=WinEventLog* "EventCode=4624" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"
[ search host="MY_IP_LIST" index="test" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"| dedup src_ip| table src_ip ]
| table src_ip, user
|dedup src_ip, user

[cmerriman]

try this:

sourcetype=WinEventLog* "EventCode=4624" [search host="MY_IP_LIST" index="test" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"| table src_ip|format]| stats count by src_ip, user|fields - count