Using a lookup to grab a host's subnet and then list out all other hosts in that subnet.

[pkeller]

I have a lookup table that includes fields for hostname and subnet. I can easily view all hosts in a subnet by searching: |inputlookup subnet_map.csv | where subnet LIKE "111.111.111.111%" | table hostname,subnet ... I'd prefer to be able to grab the subnet field from a search like: |inputlookup subnet_map.csv | where host LIKE "my_host%" | table subnet ... and push it into the "where subnet LIKE "subnet" ... so that I grab a list of all hosts in the matching subnet but by using a single hostname.

In essence, what I need to do is take the output of one inputlookup request and pipe it to a second one.

I apologize if I'm wording this poorly.

Thank you.

[pkeller]

Ultimately was able to get this sorted out by using the following search syntax ...

|inputlookup mylookup.csv | search [|inputlookup mylookup.csv | table hostname,subnet | where hostname like "foobar-host%" | return subnet ]

[gkanapathy]

You should look at subsearches: http://docs.splunk.com/Documentation/Splunk/5.0/Search/Aboutsubsearches