Splunk Search

How to use a table as input for a new search

bobstoll
New Member

Hi all. I'm trying to write a search that will list users with more than 5 failed logins in the past 8 hours and then from that result, show those users that have had a failure in the past hour. I've got the first part working with this search:

index="my_index" sourcetype="my_sourcetype" earliest=-10h@h action="failed login" | stats count by username, action | where count > 5 | table username

I now have a table with the usernames I want to run my secondary search for.

How do I take that table and run a new search against it?

Thanks in advance.

0 Karma
1 Solution

solarboyz1
Builder
index="my_index" sourcetype="my_sourcetype" earliest=-1h@h   [ search index="my_index" sourcetype="my_sourcetype" earliest=-10h@h latest=-1h@h action="failed login" | stats count by username, action | where count > 5 | table username ] 

The [subsearch] runs first, which produces the list of username which is fed to the main search.
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchTutorial/Useasubsearch#Example_2:_Search_wi...

View solution in original post

0 Karma

solarboyz1
Builder
index="my_index" sourcetype="my_sourcetype" earliest=-1h@h   [ search index="my_index" sourcetype="my_sourcetype" earliest=-10h@h latest=-1h@h action="failed login" | stats count by username, action | where count > 5 | table username ] 

The [subsearch] runs first, which produces the list of username which is fed to the main search.
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchTutorial/Useasubsearch#Example_2:_Search_wi...

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...