Hello,
I have a certain search that returns me many fields with values. Next thing I wanna do is get values of "src_ip" field and use them on an other search. I assume I can do that with a subsearch but I it is a bit cost. Other solution I thought was upload the first search's output as csv and get values form lookup but I'm not allowed to upload lookups. Can someone help me about that? Thanks.
(TLDR - Don't wanna use subsearch, need a solution.)
Ex Search: sourcetype=xxx | table src_ip -> sourcetype=yyy srcip=$src_ip$
Hi @batuhankutluca
You don't need to upload a CSV, you can create one on-the-fly like this:
sourcetype=xxx | table src_ip dvc|outputlookup ip_to_dvc.csv
Then you can do:
sourcetype=yyy |lookup ip_to_dvc.csv src_ip as srcip OUTPUT dvc
Hi @batuhankutluca
You don't need to upload a CSV, you can create one on-the-fly like this:
sourcetype=xxx | table src_ip dvc|outputlookup ip_to_dvc.csv
Then you can do:
sourcetype=yyy |lookup ip_to_dvc.csv src_ip as srcip OUTPUT dvc
So this doesn't work like subsearch right ? It saves the output of the first search to somewhere and get values for the second search from there ?
Correct, you can run this as two different searches.
This is commonly done to generate a lookup file once a day/hour etc, so you can then use it it subsequent searches.
If you wanted to run all the elements at once, there are a number of ways - subsearch as you have mentioned (but ruled out) a 'join' (also performance sucking), or couple of options with a event/stream stats commands, or even with an append.
Personally, I like the separate lookup option, but it all depends on your uses case.
Oh It fits for my problem then. Yeah as You mentioned that join and subsearch consume much resource. This method is just I wanted. Thanks sir!