Hi,
I want to use the search results as an argument for another search (with different source), like this more or less...:
source=/var/log/remots/ns_traffic.log dst=[search sourcetype="snort" | fields dest_ip]
Is this possible? Which is the right way to do it?
Thanks in advance, Alex
source=/var/log/remots/ns_traffic.log [search sourcetype="snort" | fields dest_ip | rename dest_ip as dst]
You can also take a look on the search restriction created by the subsearch by executing this search:
sourcetype="snort" | fields dest_ip | rename dest_ip as dst | format
Hi Ziegfried!
The search:
source=/var/log/remots/ns_traffic.log [search sourcetype="snort" | fields dest_ip | rename dest_ip as dst]
worked better than mine... 😉 i think that the main thing was on the rename command, which tells splunk to match the different fields, isn't it?
thanks! Alex
i think i found it...
source=/var/log/remots/ns_traffic.log |fields dst [search sourcetype="snort" dest_ip]
is that the right way to correlate the different results?
Alex
source=/var/log/remots/ns_traffic.log [search sourcetype="snort" | fields dest_ip | rename dest_ip as dst]
You can also take a look on the search restriction created by the subsearch by executing this search:
sourcetype="snort" | fields dest_ip | rename dest_ip as dst | format