Splunk Search

Use search results for another search

afont
New Member

Hi,

I want to use the search results as an argument for another search (with different source), like this more or less...:

source=/var/log/remots/ns_traffic.log dst=[search sourcetype="snort" | fields dest_ip]

Is this possible? Which is the right way to do it?

Thanks in advance, Alex

Tags (2)
0 Karma
1 Solution

ziegfried
Influencer
source=/var/log/remots/ns_traffic.log [search sourcetype="snort" | fields dest_ip | rename dest_ip as dst]

You can also take a look on the search restriction created by the subsearch by executing this search:

sourcetype="snort" | fields dest_ip | rename dest_ip as dst | format

View solution in original post

0 Karma

afont
New Member

Hi Ziegfried!

The search:

source=/var/log/remots/ns_traffic.log [search sourcetype="snort" | fields dest_ip | rename dest_ip as dst]

worked better than mine... :winking_face: i think that the main thing was on the rename command, which tells splunk to match the different fields, isn't it?

thanks! Alex

0 Karma

afont
New Member

i think i found it...

source=/var/log/remots/ns_traffic.log |fields dst [search sourcetype="snort" dest_ip]

is that the right way to correlate the different results?

Alex

0 Karma

ziegfried
Influencer
source=/var/log/remots/ns_traffic.log [search sourcetype="snort" | fields dest_ip | rename dest_ip as dst]

You can also take a look on the search restriction created by the subsearch by executing this search:

sourcetype="snort" | fields dest_ip | rename dest_ip as dst | format
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...