Splunk Search

How to use output of a 1st query list as input in second query?

agupta13
Engager

I have an 
```
index=xyz data.id=1
```
which gives me list of unique id's [1,2,3,4,5]Not sure how to store the above result to get it used for another query.

| stats count by uniqueId

Now I want to use the list above and get the data from another query and find the values
Query 2 will return 
1 -> good
2 -> Bad
3 -> Neural / etc

Index2 I want to use the result [1,2,3,4] for the next query which will give me some extra information based on the ID only. Eg: Query 2 has index=xyz data.msg.id=1, data.xyz.val=good

How can we do that?

I am trying something like this

 

index="test"
actionSubCateg IN (xyz)
landingPageURL="xyz/?search=game_gupta"
data.msg.queryName="query FindBtf"
| table data.msg.id

Find in second query the results of top

[ search index="test" 
actionSubCateg="game" 
| rename data.DATA.id as id
| fields id, scope
| table id, scope]

 



Labels (5)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can also use subsearches. If you want to limit the data from your second search to a list of ids generated in the first search, it's 

search2 [ search1 | fields id ]

where the search 1 will do the stats count by uniqueid and make the returned field 'id' in the above case. In the search2, there should be an ID that will then match against the results of search 1.

You can see the effect of what search1 passes to search 2 by running search 1 standalone and adding

| format

 to the end

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @agupta13,

the easiest solution is the jin command, but it's avery slow and not performant solution, so I hint a different approach like this:

(index="test" actionSubCateg IN (xyz) landingPageURL="xyz/?search=game_gupta" data.msg.queryName="query FindBtf") OR ([ search index="test" 
actionSubCateg="game")
| eval id=if(actionSubCateg="game",'data.DATA.id', 'data.msg.id'
| stats values(scope) AS scope values(data.xyz.val) AS val BY id

in this way you have a row for each id.

if you want you can take only the ids present in both searches adding a little condition

(index="test" actionSubCateg IN (xyz) landingPageURL="xyz/?search=game_gupta" data.msg.queryName="query FindBtf") OR ([ search index="test" 
actionSubCateg="game")
| eval id=if(actionSubCateg="game",'data.DATA.id', 'data.msg.id'
| stats values(scope) AS scope values(data.xyz.val) AS val dc(actionSubCateg) AS actionSubCateg_count BY id
| where actionSubCateg_count>1

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...