Splunk Search

Using values from search into subsearch

hoytn
Explorer

Hello,

In a timerange (lets say 4 hours) I am trying to find password resets and after that, for the same user, all the logins.
Is it possible to this in a search? I was looking at append but I don't see how I can use the field user and _time from first search (finding the password resets) to filter the second search (finding the logins)

Thank you.

Tags (1)

nvanderwalt_spl
Splunk Employee
Splunk Employee

You probably need something along these lines (adjust fields and indexes as needed)

 index=auth type=login [search index=auth type=failed  earliest=-4h |stats count by user |fields user]

Richfez
SplunkTrust
SplunkTrust

I recommend taking as much time as is necessary to fully understand the fine tutorial in the docs. Of course that requires having set up and gone through the tutorial...

Another good resource is also in the docs, the page about subsearches.

When you have really tried to understand those two things, try your search/subsearch again and see where that gets you.

Then maybe this helps - the subsearch RUNS FIRST. Right? It runs, and its results get shoved into the main search as search criteria.

mybasesearch [some search that returns a name of either "Billy" or "Sally"]
Ends up being
mybasesearch (name=Billy OR name=Sally)
E.g the subsearch JUST returns its results as search items.

(More or less. Unless you change the formatting. Etc... But I mean by default).

if you've tried both things mentioned in the help, an yet still have problems, post your SPL and both the results you get, but also the results you'd expect to have. And a few events from the results of the search (without subsearch) and the subsearch (run independently from the search).

Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...