Splunk Search

How do I use the output from one serch as input to another?

pgunn
Engager

I have a log file that comes from an email gateway (Ironmail). Each inbound message generates multple records within the log file. I need to be able to search for content in one of these records to obtain the common field in another record to retrive the results I need. Basically, using the output from one serch as input to another.
How can I do this in one step within Splunk?

Tags (1)

dwaddle
SplunkTrust
SplunkTrust

Or, you could be speaking of a transaction. It depends on how you're trying to frame it, and the type of data you're dealing with.

http://docs.splunk.com/Documentation/Splunk/5.0/Search/Identifyandgroupeventsintotransactions

http://blogs.splunk.com/2012/11/05/book-excerpt-finding-specific-transactions/

0 Karma

Lucas_K
Motivator

What you are looking for is a sub search.

http://docs.splunk.com/Documentation/Splunk/5.0/Tutorial/Useasubsearch

Your subsearch will obtain the fields from the ironmail log which is then used as fields that are sent to the outer search.

example. index=other_index [search index=ironmail some_search_string | fields email_address ]

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...