How to use the results from one inputlookup as a variable in a search of a second inputlookup?

[andyp54]

Hello

New to Splunk, so I know there is a simple answer to this, but I just can't find it 🙂

I have two inputlookup files.

input-file-A can be searched by username to return a unique id associated with that username.

I want to use this result to search input-file-B to return any fields associated with the unique id.

| inputlookup input-file-B | search unique_id=$unique_id$ [| inputlookup input-file-A | search user_name ="joe_bloggs" | fields unique_id]

...the subseatch runs and works but it's like the unique-id variable doesn't get passed; if I cut and paste a unique-id into the start of the search it also works (so I know the files are there and can be queried etc.

Any advice greatly appreciated!

[alacercogitatus · Accepted solution]

Ah, it appears you are using subsearch in a manner to which it is not inclined. When using a subsearch, you do not have to worry about tokenization. Whatever is found in the subsearch is returned in SPL, which gets appended by the primary search.

|inputlookup input-file-B | search [ inputlookup input-file-A | search user_name="joe_bloggs" | fields unique_id ]

So here, your subsearch will return:

( unique_id="joes_uniq_id" )

Which will be appended to a search command, so the "expanded" search would look like this:

| inputlookup input-file-B | search ( unique_id="joes_uniq_id" )

[andyp54]

@alacercogitatus

Thank you so much, worked perfectly 🙂