How to perform a secondary search on each result?

[uostg]

I have a search that shows network activity destined for specific IP addresses I'm interested in:

host="logserver" 1.2.3.4 OR 4.5.6.7 OR | dedup src | table src,_time

src is an extracted field showing the source IPs which have sent traffic to the destination IPs listed in the search.

I want to take each result row and perform another search on this data, to look up the MAC address from the DHCP logs. Unfortunately, time becomes a limiting factor here. The output of the first search shows when the communication took place, but the DHCP log will be at a time previous to this.

I have another search that I can plug in IP & time pairs to output the MAC address:

host=logserver $IP$
        timeformat="$tf$" endtime="$ts$"     
        | table _time dhcp_mac_addr 
        | head 1

This search uses input fields from a dashboard to allow the user to enter the "IP", "TF" and "TS" variables.

Put simply, I want to append a column to the end of the statistics table output by the first search, to show the dhcp_mac_addr field extracted from the second search, with the IP and TS values passed between the two searches.

Subsearches don't seem to allow passing variables between them and the data isn't two tables which can be easily JOINED together (due to the time differences).

Is there a way to create a search "function" which can be called for each search result row (e.g. mac_add_lookup("IP","TS"))? That would be ideal....

[aljohnson_splun · Accepted solution]

Hey @uostg - nice question. It sounds like you're interested in the map command, the definition is almost exactly what you're asking for:

The map command is a looping operator that runs a search repeatedly for each input event or result. You can run the map command on a saved search, a current search, or a subsearch.

Furthermore, it supports $field$ passing

---

In your last sentence, you ask about creating a function - you can emulate a function so to speak by creating a macro. @ mention here if you need help.

[_dave_b]

Glad I happened to see your reply, as I've been wondering about those same capabilities. Thanks for sharing!

[uostg]

That is exactly what I was looking for! Thank you so much!