Splunk Search

Use search results for another search

afont
New Member

Hi,

I want to use the search results as an argument for another search (with different source), like this more or less...:

source=/var/log/remots/ns_traffic.log dst=[search sourcetype="snort" | fields dest_ip]

Is this possible? Which is the right way to do it?

Thanks in advance, Alex

Tags (2)
0 Karma
1 Solution

ziegfried
Influencer
source=/var/log/remots/ns_traffic.log [search sourcetype="snort" | fields dest_ip | rename dest_ip as dst]

You can also take a look on the search restriction created by the subsearch by executing this search:

sourcetype="snort" | fields dest_ip | rename dest_ip as dst | format

View solution in original post

0 Karma

afont
New Member

Hi Ziegfried!

The search:

source=/var/log/remots/ns_traffic.log [search sourcetype="snort" | fields dest_ip | rename dest_ip as dst]

worked better than mine... 😉 i think that the main thing was on the rename command, which tells splunk to match the different fields, isn't it?

thanks! Alex

0 Karma

afont
New Member

i think i found it...

source=/var/log/remots/ns_traffic.log |fields dst [search sourcetype="snort" dest_ip]

is that the right way to correlate the different results?

Alex

0 Karma

ziegfried
Influencer
source=/var/log/remots/ns_traffic.log [search sourcetype="snort" | fields dest_ip | rename dest_ip as dst]

You can also take a look on the search restriction created by the subsearch by executing this search:

sourcetype="snort" | fields dest_ip | rename dest_ip as dst | format
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...