Splunk Search

Pass a value from a macro to a subsearch after doing a join

krishnab
Path Finder

Hi ,

I have a macro which gets values including host,now i do a left join .Once i do a left join in the subsearch only those host which was in previous search result should be searched.

Ex:

my search which results host
| join type=left xxx
[search index=a source=b host="host from previous search"]

Assume my first search returned many host,so in my second search after join,it should take individual host and check for any data in index=a

Tags (1)
0 Karma

splunker12er
Motivator
search1 |fields host| rename host as host1 | join host1 [search index=a source=b host="host from previous search"]
0 Karma

krishnab
Path Finder

Hi,

Thank you for your answer.

But my requirement is i should join based on some other value,but in the subsearch it should take host values from previous search(main search)

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...