I'd like to prevent code / search syntax duplication; but often times I want to use the results of a saved search to be used as the query for a bigger search. Is there a way to call an existing saved search as a subsearch without simply duplicating the entire main search? This would make it MUCH easier to maintain code and simplify viewing big complex searches. I envision something like:
index=network sourcetype=cisco [call existing report MalwareHits | rename ip as query | fields query]
I know the search part works, but I hate to actually duplicate the entire malwarehits report inline.
loadjob uses the last results of a scheduled/previously run job (in my case an ldap query) so it won't work, but the SeeAlso on the page you provided gave me |savedsearch
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Savedsearch
which is exactly what I needed! Thank you!
there is actually a savedsearch
command that you can use in a subsearch.
https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Savedsearch
loadjob uses the last results of a scheduled/previously run job (in my case an ldap query) so it won't work, but the SeeAlso on the page you provided gave me |savedsearch
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Savedsearch
which is exactly what I needed! Thank you!