Splunk Search

How do I use the output from one serch as input to another?

pgunn
Engager

I have a log file that comes from an email gateway (Ironmail). Each inbound message generates multple records within the log file. I need to be able to search for content in one of these records to obtain the common field in another record to retrive the results I need. Basically, using the output from one serch as input to another.
How can I do this in one step within Splunk?

Tags (1)

dwaddle
SplunkTrust
SplunkTrust

Or, you could be speaking of a transaction. It depends on how you're trying to frame it, and the type of data you're dealing with.

http://docs.splunk.com/Documentation/Splunk/5.0/Search/Identifyandgroupeventsintotransactions

http://blogs.splunk.com/2012/11/05/book-excerpt-finding-specific-transactions/

0 Karma

Lucas_K
Motivator

What you are looking for is a sub search.

http://docs.splunk.com/Documentation/Splunk/5.0/Tutorial/Useasubsearch

Your subsearch will obtain the fields from the ironmail log which is then used as fields that are sent to the outer search.

example. index=other_index [search index=ironmail some_search_string | fields email_address ]

Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...