Sometimes I write a brutal search that takes a very long time to run and then realize that I need to do something more to visualize it. Is there a way to just refer to the results of my already run search as input to the extra commands?
example
My manager tells me that I need to know all firewall traffic to a group of servers over the last year.
index=firewall dest_ip=192.168.100.0/24
I run this but it takes 30 hours to run. When I get the output, we see that a lot of the traffic is not interesting
now I would like to search on my original results to filter out the uninteresting traffic, something like:
[get results from sid=1510343822.12851_69BC77DB-3AFA-433E-A86E-CFDBF93FB47D]
| search NOT user in ["MonkeyA", "MonkeyB", "MonkeyC"]
| stats count(bytes_in) by dest_ip
Is there a way to do this?
Perfect! Thank you, this will save a lot of indexer and search head resources!
A couple of notes on this that I learned:
To stop worrying about the search being reaped, one can output to a lookup table:
|loadjob 1510343822.12851_69BC77DB-3AFA-433E-A86E-CFDBF93FB47D | outputlookup myResults.csv
after that, just search the lookup
|inputlookup myResults.csv
| search NOT user in ["MonkeyA", "MonkeyB", "MonkeyC"]
| stats count(bytes_in) by dest_ip