Splunk Search

How to use output of a 1st query list as input in second query?

agupta13
Engager

I have an 
```
index=xyz data.id=1
```
which gives me list of unique id's [1,2,3,4,5]Not sure how to store the above result to get it used for another query.

| stats count by uniqueId

Now I want to use the list above and get the data from another query and find the values
Query 2 will return 
1 -> good
2 -> Bad
3 -> Neural / etc

Index2 I want to use the result [1,2,3,4] for the next query which will give me some extra information based on the ID only. Eg: Query 2 has index=xyz data.msg.id=1, data.xyz.val=good

How can we do that?

I am trying something like this

 

index="test"
actionSubCateg IN (xyz)
landingPageURL="xyz/?search=game_gupta"
data.msg.queryName="query FindBtf"
| table data.msg.id

Find in second query the results of top

[ search index="test" 
actionSubCateg="game" 
| rename data.DATA.id as id
| fields id, scope
| table id, scope]

 



Labels (5)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can also use subsearches. If you want to limit the data from your second search to a list of ids generated in the first search, it's 

search2 [ search1 | fields id ]

where the search 1 will do the stats count by uniqueid and make the returned field 'id' in the above case. In the search2, there should be an ID that will then match against the results of search 1.

You can see the effect of what search1 passes to search 2 by running search 1 standalone and adding

| format

 to the end

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @agupta13,

the easiest solution is the jin command, but it's avery slow and not performant solution, so I hint a different approach like this:

(index="test" actionSubCateg IN (xyz) landingPageURL="xyz/?search=game_gupta" data.msg.queryName="query FindBtf") OR ([ search index="test" 
actionSubCateg="game")
| eval id=if(actionSubCateg="game",'data.DATA.id', 'data.msg.id'
| stats values(scope) AS scope values(data.xyz.val) AS val BY id

in this way you have a row for each id.

if you want you can take only the ids present in both searches adding a little condition

(index="test" actionSubCateg IN (xyz) landingPageURL="xyz/?search=game_gupta" data.msg.queryName="query FindBtf") OR ([ search index="test" 
actionSubCateg="game")
| eval id=if(actionSubCateg="game",'data.DATA.id', 'data.msg.id'
| stats values(scope) AS scope values(data.xyz.val) AS val dc(actionSubCateg) AS actionSubCateg_count BY id
| where actionSubCateg_count>1

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...