I have a search that returns a number of UserNames. I would like to extract just the usernames [field:UserName] from the search results and then do a follow on search for all the items that have those usernames in them.
Search and return 'ListOfUsers'
Use 'ListOfUsers' to Search index=* (or separate broad search) to return ALL activity from 'ListOfUsers'
Sure.
index=* [ search your_search_for_users | table UserName ] | do_other_things
But.... subsearches are inefficient, since they consume 2 cpus per execution. A nicer way would be to keep a lookup of users, and then use the lookup in the search.
The Saved Search that runs every so often:
index=whatever find_your_users | table UserName | outputlookup interesting_users.csv
Then use it in a "sub-searchy" kind of way.
index=* other_criteria [ | inputlookup interesting_users.csv | table UserName ]
Sure.
index=* [ search your_search_for_users | table UserName ] | do_other_things
But.... subsearches are inefficient, since they consume 2 cpus per execution. A nicer way would be to keep a lookup of users, and then use the lookup in the search.
The Saved Search that runs every so often:
index=whatever find_your_users | table UserName | outputlookup interesting_users.csv
Then use it in a "sub-searchy" kind of way.
index=* other_criteria [ | inputlookup interesting_users.csv | table UserName ]
This is a great use case for a subsearch. You would have your entire search be:
[search <search criteria for the list of users> | fields UserName] <search for activities>
The subsearch will output a series usernames that are then criteria for the broader search. Make sure you start your subsearch with "search."
That works to input a field into a more limited search. Is there a way to port those results into a wider search. Like back into index=* UserNameList