How to use subsearch results as values in a different field of parent search?

[frbuser]

Hello,

I am working with Windows event logs in Splunk. Specifically, process execution (EventCode 4688) logs.

I have a subsearch looking for specific events and I am trying to return the New_Process_IDs of those results and use it as the Creator_Process_IDs of the parent search.

Subsearch

index=windows_event_logs Creator_Process_Name="C:\\Program Files\\Microsoft Office\\Office16\\OUTLOOK.EXE" | return $New_Process_ID

Parent Search

index=windows_event_logs Creator_Process_ID=$New_Process_ID

How do you return a list of values from a subsearch and use it as criteria for a different field in the parent search?

[traxxasbreaker · Accepted solution]

An easy way is to rename the field within the subsearch to match what's in your parent search, similar to this:
index=windows_event_logs [search index=windows_event_logs Creator_Process_Name="C:\\ProgramFiles\\Microsoft Office\\Office16\\OUTLOOK.EXE" | rename New_Process_ID AS Creator_Process_ID | fields Creator_Process_ID]

[frbuser]

Creator_Process_ID exists as a field already in both searches.

[traxxasbreaker]

Makes sense, just rename within your subsearch to override the existing value of Creator_Process_ID with the field you want to match up to the parent search's Creator_Process_ID instead. This way it will match up with the values in the parent search.

For a more general example, let's say you wanted to use values of field foo in your child search as criteria for filtering field bar in your parent search. You would need to rename foo in your subsearch to bar so it would match up to the field bar in your parent search.

[frbuser]

Seems like this worked. Thanks!