Splunk Search

Expanding on a search result automatically

Eldad
Explorer

Hi,

I am trying to figure out how to achieve something and would appreciate any help from your experience.

I have a view showing some search results. There are two extracted fields. One is source IP address and the second is destination IP address. Now let's say I search for all events that have a certain destination IP address. I can easily get all extracted source IP addresses. Now the tricky part: I want to search for all events with the extracted source IP address and for those events extract all destination IP addresses. Today I need to do this manually, copy each source IP into a new search, extract the destination IPs and then again copy them one by one into a new search.

Is there an easier way to do this? If not, is it possible to add this functionality by myself?

Thanks for the help!

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

I think for this you will need a subsearch. It will look something like this:

foo [ search destip=216.248.156.24 | dedup srcip | fields srcip ]

With a subsearch, splunkd will run the search within the brackets, and then the rows and fields of the subsearch get automatically turned into a boolean expression.

The end result is that splunkd will run this search:

foo ( srcip=A OR srcip=B OR srcip=C OR srcip=D OR ...... )

which I think is what you want.

View solution in original post

sideview
SplunkTrust
SplunkTrust

I think for this you will need a subsearch. It will look something like this:

foo [ search destip=216.248.156.24 | dedup srcip | fields srcip ]

With a subsearch, splunkd will run the search within the brackets, and then the rows and fields of the subsearch get automatically turned into a boolean expression.

The end result is that splunkd will run this search:

foo ( srcip=A OR srcip=B OR srcip=C OR srcip=D OR ...... )

which I think is what you want.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...