I have a lookup table that includes fields for hostname and subnet. I can easily view all hosts in a subnet by searching: |inputlookup subnet_map.csv | where subnet LIKE "111.111.111.111%" | table hostname,subnet ... I'd prefer to be able to grab the subnet field from a search like: |inputlookup subnet_map.csv | where host LIKE "my_host%" | table subnet ... and push it into the "where subnet LIKE "subnet" ... so that I grab a list of all hosts in the matching subnet but by using a single hostname.
In essence, what I need to do is take the output of one inputlookup request and pipe it to a second one.
I apologize if I'm wording this poorly.
Thank you.
Ultimately was able to get this sorted out by using the following search syntax ...
|inputlookup mylookup.csv | search [|inputlookup mylookup.csv | table hostname,subnet | where hostname like "foobar-host%" | return subnet ]
You should look at subsearches: http://docs.splunk.com/Documentation/Splunk/5.0/Search/Aboutsubsearches