Splunk Search

Using values from search into subsearch

hoytn
Explorer

Hello,

In a timerange (lets say 4 hours) I am trying to find password resets and after that, for the same user, all the logins.
Is it possible to this in a search? I was looking at append but I don't see how I can use the field user and _time from first search (finding the password resets) to filter the second search (finding the logins)

Thank you.

Tags (1)

nvanderwalt_spl
Splunk Employee
Splunk Employee

You probably need something along these lines (adjust fields and indexes as needed)

 index=auth type=login [search index=auth type=failed  earliest=-4h |stats count by user |fields user]

Richfez
SplunkTrust
SplunkTrust

I recommend taking as much time as is necessary to fully understand the fine tutorial in the docs. Of course that requires having set up and gone through the tutorial...

Another good resource is also in the docs, the page about subsearches.

When you have really tried to understand those two things, try your search/subsearch again and see where that gets you.

Then maybe this helps - the subsearch RUNS FIRST. Right? It runs, and its results get shoved into the main search as search criteria.

mybasesearch [some search that returns a name of either "Billy" or "Sally"]
Ends up being
mybasesearch (name=Billy OR name=Sally)
E.g the subsearch JUST returns its results as search items.

(More or less. Unless you change the formatting. Etc... But I mean by default).

if you've tried both things mentioned in the help, an yet still have problems, post your SPL and both the results you get, but also the results you'd expect to have. And a few events from the results of the search (without subsearch) and the subsearch (run independently from the search).

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...