How to output of search results of one index as inputs to another search using a different index?

[Thuan]

I search Netflow firewall denied traffic on port 53 using the netflow index. Based on the IPs found (source and DNS destination server), subsequently and using the DNS index I want to find out the domain name of the specific queries that were blocked. How can this be done by passing the source and destination IPs obtained in the 1st search to the 2nd search?

[Thuan]

Your promptness is much appreciated.
I forgot to mention that subsearch has certain limitations, e.g., limits on search time or number of returned entries. In my case I don't want to be constrained by the limits imposed by the subsearch. In fact, the first search retrieves a number of suspicious events which trigger more extensive searches in different indexes to build a "context" for a potential security issue. What is a working scheme without using subsearch?

[Ayn]

This is pretty much exactly what subsearches are made for. The docs have excellent explanations on how to use them so I'll just link to those: http://docs.splunk.com/Documentation/Splunk/6.0/SearchTutorial/Useasubsearch

[lguinn2]

Try this, which uses a subsearch.

index=dns [ search index=netflow port=553 firewall denied | dedup src_ip dest_ip | table src_ip dest_ip ]

I probably don't have the search terms right, but I think you can figure it out from this starting point!

[SUHANISH0910]

Hi - In this example it was mentioned like filtering data from different indexes also, but when I tried that it is not working what is the syntax of using 2 indexes with same search pattern and get both indexes values at same time. Please advise.

@Anonymous 

Thanks

Venkatesh

[yuanliu]

@SUHANISH0910 Please post your question as a new post, including your sample code and sample results to illustrate the problem/difficulty.