Splunk Search

search on subsearch using data from main search results

taufiqkpi
Loves-to-Learn

hello Splunkers!
I've got an issue with this query, in "main search" I got data src, can I use "src" to get data on my "second search".
later on, the final result ignored from "main search "
anyone can help me?
thanks,

index=VPN | table src -> main search
    [search index=firewall | table src dest_ip] -> second search
    | table src dest_ip

 

Labels (2)
Tags (3)
0 Karma

scelikok
SplunkTrust
SplunkTrust

So, my search should work for you.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

taufiqkpi
Loves-to-Learn

Sorry this solution not solving my problem

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @taufiqkpi,

I think you want to filter VPN sources from Firewall index, please try below;

search index=firewall NOT 
    [ index=VPN 
    | fields src] 
| table src dest_ip
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

taufiqkpi
Loves-to-Learn

Sory sir @scelikok, I mean from main search we get src fields.

 

index=VPN | table src

 

after this, fileds src from "main search" as search data to "second search"

 

[search src="from data main search" index=firewall | table src dest_ip]
    | table src dest_ip

 

 

Tags (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...