Splunk Search

Subsearch Not Filtering Results

jcullins21
New Member

I am trying to pull a list of filtered IPs from one index and then use that list as a reference to see external traffic from another index. When I run the subsearch command alone it works perfectly and gives me the list I desired. But when I throw the outer search in the mix it gives me all the IP addresses associated with "that_place" and nothing is filtered.

Index= two sourcetype=two dest_ip!=22.*
[ search index=one sourcetype=one
os_type="Thing_1" OR os_type="Thing_2" OR os_type="Thing_3"
NOT os_type!="Thing_4"
NOT os_description="Thing_5"
NOT os_description="Thing_6"
NOT os_hostname="Thing_7"
place="that_place" rename ip AS src | dedup src | table src]
| table src,dest_ip,dest_port,bytes_in,bytes_out

I'm pretty new to Splunk and I know there has to be a better way to complete a simple search across different indexes.

0 Karma

jcullins21
New Member

Sorry that was a typo. should read:

place="that_place" | rename ip AS src

0 Karma

sushantmhatre
Explorer

place="that_place" rename ip AS src

In your rename command, there is no leading pipe or its typo ?

Anyways I think better to move dedup in outer search

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...