Splunk Search

Search result as input to another search

mcm10285
Communicator

Hi, anybody has an idea on how to get a value from one search and input it to another search, then display them in a table? Sample below.

I’ll search for IP_Address on 1st search, then take that into 2nd search and find the Hostnames of those ip address…then display them

Search1:

sourcetype=srctype1 OR sourcetyp=srctype2 dstIP=1.1.1.1 OR dstIP=2.2.2.2|fields + srcIP dstIP|stats count by srcIP

Search2:

sourcetype=srctype3 (input srcIP from Search1)|fields + Hostname|stats count by srcIP Hostname

Display Table:

srcIP__________Hostname

a.b.c.d_______________abcd

Tags (2)
1 Solution

Ayn
Legend

This is exactly what subsearches were made for. Have a look at the docs that cover this: 
https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Useasubsearch

 

View solution in original post

ysouchon
Explorer

I'm not sure if I understood your question, but you should try something like :

sourcetype=srctype3 | join [ search sourcetype=srctype1 OR sourcetyp=srctype2 dstIP=1.1.1.1 OR dstIP=2.2.2.2 | fields + srcIP dstIP | stats count by srcIP ] | fields + Hostname | stats count by srcIP Hostname

And see what you get. Let me know if it helps you.

mbenwell
Communicator

When you get errors like that, you should read the search command reference for that command. Specifically, with regards to the fields command, you're not using it properly.

Fields command synopsis: Keeps or removes fields from search results.

0 Karma

Ayn
Legend

Uh, wouldn't be better to put your energy into troubleshooting your syntax problems with the probably best approach to solving your problems, rather than trying something else just because you couldn't get it right?

mcm10285
Communicator

I did try the subsearch, however i kept running into the error "Error in 'fields' command: Invalid argument: 'fieldname=field_value'.

Then I ran into one of the Answers on another post, saying I Should add "|rename field as query". This one doesn't go into errors but doesn't get results either.

I'm looking into a document about creating State Tables.

Thanks.

0 Karma

mbenwell
Communicator

As Ayn said, subsearch is what you want. Perform a subsearch for the proxy event then feed that into a search through ad logs. It should look something like:

sourcetype=ad_logs [search sourcetype=proxy_logs | fields ip_address] | table user ip_address

Keep in mind the above assumes your proxy logs have the ip address in a fields called ip_address, and your ad logs have the username and ip address in fields user and ip_address respectively

0 Karma

mcm10285
Communicator

This is really an old post, but I'm still looking for a way here. The join doesn't seem to resolve this as it mixes the results.

Just to be exact, I want to match an IP address from a proxy log to a device name or username from AD logs since there is no device name in the proxy logs. I want to input the IP address seen in proxy logs to the AD logs search for device name.

0 Karma

Ayn
Legend

This is exactly what subsearches were made for. Have a look at the docs that cover this: 
https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Useasubsearch

 

tuxmein
New Member

The link in the Accepted Answer link text seems to no longer reach an answer to this question because of update to SPLUNK. When I try it I get page that says:

Hi! Just wanted to let you know:

The topic you've asked to see does not apply to the most recent version.

To search the latest version of the documentation, click Search

0 Karma

mcm10285
Communicator

just trying to get back on old questions....subsearch is definitely the way to go but not efficient for multiple subsearch results.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...