Splunk Search

Using search fields to compare against custom command

jgauthier
Contributor

Not the best subject. I'm not sure how to explain it in the title. But I'd like to use the results of an custom search to limit my search results. psuedo-code:

custom_search returns a field named "custom_results"
sourcetype of "xyz" has a field called "expected_results"

sourcetype="xyz" | custom_search | search expected_results=custom_results

However, the search command takes the "results" literally, instead of the field contents.
How is this achieved?

Thanks!

Tags (3)
0 Karma

lguinn2
Legend

Use where instead of search -

sourcetype="xyz" | custom_search | where expected_results=custom_results

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...