Splunk Search

How do I use the output from one serch as input to another?

pgunn
Engager

I have a log file that comes from an email gateway (Ironmail). Each inbound message generates multple records within the log file. I need to be able to search for content in one of these records to obtain the common field in another record to retrive the results I need. Basically, using the output from one serch as input to another.
How can I do this in one step within Splunk?

Tags (1)

dwaddle
SplunkTrust
SplunkTrust

Or, you could be speaking of a transaction. It depends on how you're trying to frame it, and the type of data you're dealing with.

http://docs.splunk.com/Documentation/Splunk/5.0/Search/Identifyandgroupeventsintotransactions

http://blogs.splunk.com/2012/11/05/book-excerpt-finding-specific-transactions/

0 Karma

Lucas_K
Motivator

What you are looking for is a sub search.

http://docs.splunk.com/Documentation/Splunk/5.0/Tutorial/Useasubsearch

Your subsearch will obtain the fields from the ironmail log which is then used as fields that are sent to the outer search.

example. index=other_index [search index=ironmail some_search_string | fields email_address ]

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...