Use subsearch to gather ip addresses for use in another type off search?

[einars]

Playing around to find a way to gather IP-Addresses from one type of search, to gather other type of information about the ip-addresses.

In this example I try to gather all ip-addresses that is in the source type threat log, this source type does not contain session_end_reason, that is in the traffic log. So, I try to fetch all ip addresses that accsess *sonos.com* and use this to get all session_end_reason for those ip addresses. Mayby it’s not possible, and it’s a proof of concept i try achieving here.

index="paloalto" src_ip="*" src_ip="*"
[search index="paloalto" url="*sonos.com*" src_ip="*"]
| table url src_ip session_end_reason

The result from this gives blank session_end_reason

If I have this in my first search:

index="paloalto" src_ip="*" src_ip="*" session_end_reason="*"

All ends up blank.

This at the end:

| table src_ip session_end_reason

Ends up with only ip addresses, and no session_end_reason

Is this possible?

Best regards

[richgalloway · Accepted solution]

When testing query that contains a subsearch, start with the subsearch by itself.  Remember that the results of the subsearch will become part of the main search.  That means every field returned by the subsearch will be searched for by the main search.  If the main search only needs one field from the subsearch then be sure to include a fields command in the subsearch to return only that one field.

index="paloalto" 
[search index="paloalto" url="*sonos.com*" src_ip="*" | fields src_ip | format ]
| table url src_ip session_end_reason

[einars]

Perfect, works like I want it to do:

index="paloalto"  [search index="paloalto" "*sonos.com*" src_ip="*" 
| fields src_ip | format ]  
| stats count by src_ip session_end_reason 
| sort by src_ip

@richgalloway 

thanks a lot, spent a good amount of time digging. Really good explanation you provided.