Use subsearch results as data in outer search

[nicolasperrenou]

Hi

I have a subsearch which searches for certain events (suspicious requests that sometimes happen after a user has logged into my system) inside an apache access log. The fields I need are the IP and the timestamp. The IP is used as a search query in the outer search, which is a query to an authentication log. In the final results, I need all the data of the outer search (the auth log), the IP (which is part of both logs) and the timestamp that comes from the access log (which is not part of the search condition).

How can I achieve this results set the most performant way? The set and join commands are too slow as the auth log is very large. What I'm currently doing is (in pseudo code)

search_auth_log [ search_access_log | fields +ip ] OR search_access_log | transaction ip 

It works, but the drawback is that I have to do the subsearch query two times. Is there a better solution?

Thanks and best regards

[sideview]

The best approach is probably to combine the searches into a disjunction and not use join at all.

(<search 1>)  OR (<search 2>) 

and then pipe that to something like

| stats dc(user) by IP

Can you give more details of the exact searches?