Splunk Search

How to automatically initiate second search using the results of the first search

Itsecuser1
New Member

index=logs  appname="nameofapp " url=somewebsitenamestring     |  stats count by user | sort - count | where count > 100

I would get results of 5 users and i want to initiate a different search using the results ,  can you let me know how i can do it 

index=logs   appname="appname  " user="here i need those 5 user names  found in the results to be inserted   "    url=*somewebsitenamestring   |   table _time user url  

I would prefer to receive 5 individual csv files for each user rather than one file with all 5 user data.

 

Thanks for your help , please let me know if this is possible 

 

 

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=logs   appname="appname url=*somewebsitenamestring   
 [ search index=logs  appname="nameofapp " url=somewebsitenamestring     |  stats count by user | where count > 100 | table user ]
|   table _time user url
  
0 Karma

Itsecuser1
New Member

Thanks a lot , i am able to view the results of the  user  , but i am not able to see a statistics table sorted by the user with the highest  count  , please can you let me know if it is possible to display the table 

Also is it possible to generate a CSV file for each individual user with the highest count ( higher than 100)  as part of an alert or as a report 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=logs   appname="appname url=*somewebsitenamestring   
 [ search index=logs  appname="nameofapp " url=somewebsitenamestring     |  stats count by user | where count > 100 | table user ]
| eventstats count by user
| sort -count
| table _time user url count

I don't think you can generate a csv file for each user, you can generate a csv file but it would contain all the results.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...