Hello
New to Splunk, so I know there is a simple answer to this, but I just can't find it 🙂
I have two inputlookup files.
input-file-A can be searched by username to return a unique id associated with that username.
I want to use this result to search input-file-B to return any fields associated with the unique id.
| inputlookup input-file-B | search unique_id=$unique_id$ [| inputlookup input-file-A | search user_name ="joe_bloggs" | fields unique_id]
...the subseatch runs and works but it's like the unique-id variable doesn't get passed; if I cut and paste a unique-id into the start of the search it also works (so I know the files are there and can be queried etc.
Any advice greatly appreciated!
Ah, it appears you are using subsearch in a manner to which it is not inclined. When using a subsearch, you do not have to worry about tokenization. Whatever is found in the subsearch is returned in SPL, which gets appended
by the primary search.
|inputlookup input-file-B | search [ inputlookup input-file-A | search user_name="joe_bloggs" | fields unique_id ]
So here, your subsearch will return:
( unique_id="joes_uniq_id" )
Which will be appended to a search
command, so the "expanded" search would look like this:
| inputlookup input-file-B | search ( unique_id="joes_uniq_id" )
Ah, it appears you are using subsearch in a manner to which it is not inclined. When using a subsearch, you do not have to worry about tokenization. Whatever is found in the subsearch is returned in SPL, which gets appended
by the primary search.
|inputlookup input-file-B | search [ inputlookup input-file-A | search user_name="joe_bloggs" | fields unique_id ]
So here, your subsearch will return:
( unique_id="joes_uniq_id" )
Which will be appended to a search
command, so the "expanded" search would look like this:
| inputlookup input-file-B | search ( unique_id="joes_uniq_id" )
@alacercogitatus
Thank you so much, worked perfectly 🙂