Dashboards & Visualizations

Dashboard: Using the values of a previous search in another search

Kate_Lawrence-G
Contributor

I have a list of MAC addresses that indicate a unit is in production and a subsequent Perl script that pulls 10 at random every 10 minutes and populates a CSV that splunk has configured as a lookup. I then join that MAC to a subsearch to get the current IP address that corresponds to those random MAC addresses to get the current activity over 24 hours.

|inputlookup top10.csv | join mac [search source=stuff] | stats values(mac) by ipaddress

This works fine and is integrated in my dashboard as a simple results table.

The question is how can I use the returned value of the ipaddress field in a new or postprocess search?

Thanks!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

First of all, your search would be much better as:

source=stuff 
[ inputlookup top10.csv 
  | fields mac ] 
| stats values(mac) by ipaddress

Second we then re-use this version in a nested subsearch to answer your original question:

source=mysecondsetofdata 
[ source=stuff 
  [ inputlookup top10.csv 
    | fields mac ] 
  | stats values(mac) by ipaddress ] 
| fields ipaddress ]

This would search mysecondsetofdata for any events that had a field ipaddress where it equaled one of the values of ipaddress returned by the outer subsearch.

Kate_Lawrence-G
Contributor

Thanks! That's it! I think I was getting caught up on that join....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...