Splunk Search

subsearch help

mcbradford
Contributor

Not sure how to accomplish this....

First search:

index="airtight" message=quarantined eventtype="airtight_intrusion" NOT Agere | stats count by client_mac

If results are returned from first search, take the results "client_mac" and perform this search

sourcetype="nac" client_mac

display results

does this look correct?

sourcetype="nac" [search index="airtight" message=quarantined eventtype="airtight_intrusion" NOT Agere | return 100 client_mac] | stats count by client_mac, Users_Name, Company, _time

Tags (2)
0 Karma

dart
Splunk Employee
Splunk Employee

I'd do
sourcetype="nac" [search index="airtight" message=quarantined eventtype="airtight_intrusion" NOT Agere | dedup client_mac| fields client_mac]

if you want to search for sourcetype=nac client_mac=XXX OR client_mac=YYY
or

sourcetype="nac" [search index="airtight" message=quarantined eventtype="airtight_intrusion" NOT Agere | dedup client_mac| format "" "" "" "" "OR" ""]

if you want to search sourcetype="nac" XXX OR YYY

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...