How to create a subsearch which would generate a csv file and use this as input for another search string at same point in time.

[Veeruswathi]

Hi all,

I would like to generate the csv file form one search and use that as lookup file for another query .

Here the problem is i want the csv file to update the same time i run the second query !

Any ideas on this would be much appreciated.

Thanks,
Swathi

[Veeruswathi]

Thankyou for you reply Azeemering.

Should i run the base-search to create the lookup for all time only once?? or should i save it somewhere.(If yes, as what?)

Thanks,
Swathi

[Azeemering · Accepted solution]

Allright, so you want to create an inputlookup file I assume.

First create the inputlookup by running a base search/cache and write it to a csv file

Example:

tag=web url=*
| eval list="mozilla"
| `ut_parse_extended(url,list)`
| stats earliest(_time) as earliest latest(_time) as latest by ut_domain
| outputlookup previously_seen_domains.csv

Once you have the baseline, we can create a search that compares the data and will update the CSV file with the new data:

tag=web url=* earliest=-15m
| eval list="mozilla"
| `ut_parse_extended(url,list)`
| stats earliest(_time) as earliest latest(_time) as latest by ut_domain
| inputlookup append=t previously_seen_domains.csv
| stats min(earliest) as earliest max(latest) as latest by ut_domain
| outputlookup previously_seen_domains.csv

The key here is the append=t command. (use google 🙂