Splunk Search

How do I use the output from one serch as input to another?

pgunn
Engager

I have a log file that comes from an email gateway (Ironmail). Each inbound message generates multple records within the log file. I need to be able to search for content in one of these records to obtain the common field in another record to retrive the results I need. Basically, using the output from one serch as input to another.
How can I do this in one step within Splunk?

Tags (1)

dwaddle
SplunkTrust
SplunkTrust

Or, you could be speaking of a transaction. It depends on how you're trying to frame it, and the type of data you're dealing with.

http://docs.splunk.com/Documentation/Splunk/5.0/Search/Identifyandgroupeventsintotransactions

http://blogs.splunk.com/2012/11/05/book-excerpt-finding-specific-transactions/

0 Karma

Lucas_K
Motivator

What you are looking for is a sub search.

http://docs.splunk.com/Documentation/Splunk/5.0/Tutorial/Useasubsearch

Your subsearch will obtain the fields from the ironmail log which is then used as fields that are sent to the outer search.

example. index=other_index [search index=ironmail some_search_string | fields email_address ]

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...