Splunk Search

How do I use the output from one serch as input to another?


I have a log file that comes from an email gateway (Ironmail). Each inbound message generates multple records within the log file. I need to be able to search for content in one of these records to obtain the common field in another record to retrive the results I need. Basically, using the output from one serch as input to another.
How can I do this in one step within Splunk?

Tags (1)


Or, you could be speaking of a transaction. It depends on how you're trying to frame it, and the type of data you're dealing with.



0 Karma


What you are looking for is a sub search.


Your subsearch will obtain the fields from the ironmail log which is then used as fields that are sent to the outer search.

example. index=other_index [search index=ironmail some_search_string | fields email_address ]

Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...