Using search result as object of another search in same query (2024)

FAQs

How do I use results from one search in another in Splunk? ›

To use the results of a search in another search, use what Splunk calls a subsearch. Subsearches are enclosed by square brackets and execute first so the one that produces results runs as the subsearch. Those results become part of the main search.

You must run the first search to identify the piece of information that you need, and then run the second search with that piece of information. You can combine these two searches into one search that includes a subsearch.

The first query needs to go as a subsearch (the part in []) and return the needed field back to the main search (which in your case is the second query). You can select which field to use as a result in the main search with the return command. Normally it would look something like "field=value1 OR field=value2 OR ...."

4) Deployment Server

Centralized Management: The deployment server helps manage Splunk configurations by consolidating them into one server, making it easier to manage instance consistency.

By default, subsearches return a maximum of 10,000 results and have a maximum runtime of 60 seconds.

The command that can be used to further filter results in a search is the subsearch command.

To search on a keyword, select the Keyword tab, type the keyword or phrase you want to search on, then press Enter. If you want to search on a field, select the Fields tab, enter the field name, then press Enter. To continue adding keywords or fields to the search, select Add Filter.

Where are Splunk search results stored? ›

'sid' is the Search ID, and also the name of the folder in your dispatch directory. Job results are stored in the dispatch directory on the search head: $SPLUNK_HOME/var/run/splunk/dispatch. The SID should match the name of the directory in there.

If you put the sought strings in the base search then Splunk will search all fields for them. Then you can use the fields command to select the fields you want in the output. index=centre_data ("DAN012A Dance" OR "2148 FNT004F Nutrition Technology") | fields ... If this reply helps you, Karma would be appreciated.