Splunk Search

How to whitelist through subsearching with out lookups?

Henesys
New Member

So there's ton of documentations of whitelisting through the subsearch approach using lookups, however, is it possible to whitelist using another search criteria within a search?

For example...

| search 1 index=blah1

[ sub search 2 index=blah2 ]

| if user in search 2 is in 1, whitelist

Remember, I know how to whitelist through lookups. Just curious to know if there is another way.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| search 1 index=blah1

[ sub search 2 index=blah2 | dedup user | table user]
0 Karma

Henesys
New Member

Not quite what I'm looking for. That would just simply output a table with user regardless if user from search 2 was in search 1.

 

Is there anyway to make it so it can correlate or match and provide a new field saying matched between the two searches?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure I understand - the subsearch with dedup and table essentially produces a list of users found in the subsearch e.g. ((user=="user1") OR (user=="user2")), which is added to the end of the initial search, thereby whitelisting the users from the main search. Is this not what you want to do?

(This is similar to

search ... [| inputlookup lookupfile.csv | dedup user | table user]

which you may have seen elsewhere.)

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...