Splunk Search

Use the result of one query as input to the next query


Hi @niketn 


I have a requirement where..

My first query is as below:

index = <my_index> eventtype=" " | table field1

And the values of my first query has to be used in the search of my second query

index=<my_index> source= " " and field1 values..

I tried using join it doesnt seem to help.


Please advice

Labels (2)
0 Karma


use fields comand not table,  also if the result of the first search are less number of events you can use a subsearch.

index=<my_index>  [search index = <my_index> eventtype=" " |  fields field1]

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...