How to use values from one search to another search?

[batuhankutluca]

Hello,
I have a certain search that returns me many fields with values. Next thing I wanna do is get values of "src_ip" field and use them on an other search. I assume I can do that with a subsearch but I it is a bit cost. Other solution I thought was upload the first search's output as csv and get values form lookup but I'm not allowed to upload lookups. Can someone help me about that? Thanks.
(TLDR - Don't wanna use subsearch, need a solution.)

Ex Search: sourcetype=xxx | table src_ip -> sourcetype=yyy srcip=$src_ip$

[nickhills · Accepted solution]

Hi @batuhankutluca
You don't need to upload a CSV, you can create one on-the-fly like this:

sourcetype=xxx | table src_ip dvc|outputlookup ip_to_dvc.csv

Then you can do:

sourcetype=yyy |lookup ip_to_dvc.csv src_ip as srcip OUTPUT dvc

[batuhankutluca]

So this doesn't work like subsearch right ? It saves the output of the first search to somewhere and get values for the second search from there ?

[nickhills]

Correct, you can run this as two different searches.
This is commonly done to generate a lookup file once a day/hour etc, so you can then use it it subsequent searches.

If you wanted to run all the elements at once, there are a number of ways - subsearch as you have mentioned (but ruled out) a 'join' (also performance sucking), or couple of options with a event/stream stats commands, or even with an append.

Personally, I like the separate lookup option, but it all depends on your uses case.

[batuhankutluca]

Oh It fits for my problem then. Yeah as You mentioned that join and subsearch consume much resource. This method is just I wanted. Thanks sir!