Splunk Search

How to use the output from one search as input for another search?

mkatz
New Member

I have a search that results in an IP address as the result with the field name clientIP:

host=hostname SSL=TLSv1.2 | stats count by clientIP

Now I want to take the results and use as a search using the same values for clientIP, renamed as RequestIP, such that I'm using the IP addresses from the initial result and using that to count addresses:

host=hostname2 RequestIP | stats count by task
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this

 host=hostname2 [search host=hostname SSL=TLSv1.2 | stats count by clientIP | table clientIP | rename clientIP as RequestIP ] | stats count by task

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this

 host=hostname2 [search host=hostname SSL=TLSv1.2 | stats count by clientIP | table clientIP | rename clientIP as RequestIP ] | stats count by task
0 Karma

MuS
SplunkTrust
SplunkTrust

Just a side note on using subsearches, they have a hard limit - see docs for more details http://docs.splunk.com/Documentation/Splunk/6.3.0/Search/Aboutsubsearches

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mkatz,

you can combine the searches and run it as one search by using the filldown command:

 host=hostname SSL=TLSv1.2 OR host=hostname2 RequestIP | filldown clientIP RequestIP | where clientIP=RequestIP | stats count by task 

This is un-tested since I don't have your events available, but should get you started.

cheers, MuS

0 Karma

mkatz
New Member

I don't think I explained it very well. I want to take the results of a search that gives me a list of IP addresses and use that list of IP addresses as part of the input for another search. In the first search the IP addresses is in the form of clientIP=IPAddress, but for the second search it needs to be RequestIP=IPAddress as the IPAddress has a different label in the second search.

0 Karma

MuS
SplunkTrust
SplunkTrust

Can you provide one example each?

0 Karma

kserra_splunk
Splunk Employee
Splunk Employee

You might want to try a subsearch to search based off the results of your previous search, there are some examples listed here

http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchTutorial/Useasubsearch

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...