Splunk Search

Using search result as object of another search in same query

kryshael
Loves-to-Learn

I am learning Splunk (early stages). I have been playing around with this search for the past 2 hours with little success.

 

I am running this query to get an ip address of the workstation this person is using:

index=fortinet* user=XXXX* | top limit=1 sip | table sip

I am trying to tie this search in with another index search ( index=wineventlog_pc ) and use that ip address as the source to find the actual name of the workstation being used.

 

Any help or insights would be awesome. Thank you

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To use the results of a search in another search, use what Splunk calls a subsearch.  Subsearches are enclosed by square brackets and execute first so the one that produces results runs as the subsearch.  Those results become part of the main search.

Using the example searches from the OP:

 

 

index=wineventlog_pc [ 
  | index=fortinet* user=XXXX* | top limit=1 sip | format ]

 

 

 The fortinet index is searched first and the results are converted by the format command into "sip=foo". Then the main search becomes index=wineventlog_pc sip=foo.  Of course, the two indexes must use the same field name ("sip", in this case).  If the don't then the subsearch must rename the field to match the name used in the main search.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...