Splunk Search

How can I search for a file and then use the name of that file to drive the next search?

dmoulais
New Member

I have a collection of hundreds of files. I want to write a search that (1) finds which file has a certain keyword and then (2) search that particular file for additional content for tabling.

Searching for the specific file is done as follows ...

source="jobs/*" "load = 1234" | dedup source

... but I have been googling/trying to figure out how to use that source to drive the next part of the query. Here is some pseudocode with source renamed for ?clarity? as so far I have not been able to find a good way.

source="jobs/*" "load = 1234" | dedup source | rename source as XX | search source=XX "mysearchstring"

Tags (1)
0 Karma

teunlaan
Contributor

Think you want to use a subsearch:

"mysearchstring" [ search source="jobs/*" "load = 1234" | dedup source | table source ] 

SubSearch doc

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...