#SPLUNK SUBSEARCH BASED ON RESULTS MAC#

Here also as you can see everything’s the same as earlier but the only change is with the “return” command. You can alter as per the requirement of your primary search.Įxample 4: index='sample_set' sourcetype=access_combined_wcookie action=view status=200 | top ip | return $ip we return the value of ‘ip’ field in an alias named as “client_ip”. You can also know about : Usage of Splunk commands : ADDTOTALSĮxample 3: index='sample_set' sourcetype=access_combined_wcookie action=purchase status=200 | top ip | return client_ip=ipĪs you can see everything is the same as earlier but the only change is with “return” command. Now this time we are using |return 10, to get 10 ip values in the search field. we want to see who viewed our product most), and then using top command we bring the most viewed ip’s and last we used return command to return our result. Then we have added two filters “action=view” and “status=200” (i.e. Here we took data from the “sample_set” index and “access_combined_wcookie” sourcetype,which consist of data related to an online merchant site. By using the return command it only brings one column, which consists of the “ip” value.Įxample 2: index='sample_set' sourcetype=access_combined_wcookie action=view status=200 |top ip |return 10 ip As we can see that it brings the result in the form of a field value pair (i.e. By default return command use “|head 1” to return the 1st value.

$ – Name of the fields to return with “$” sign, you can mention more than one field name separated by spaces.Īt first we will see how the “return” command returns the result, then we will use that query as a sub search within a primary search and will try to understand the function.Įxample 1: index='sample_set' sourcetype=access_combined_wcookie action=view status=200 |top ip |return ip – Name of the fields to return, you can mention more than one field name separated by spaces. = – Mention field alias and field name of values to be returned, you can mention more than one = pair separated by spaces. – Number of results you want to return (default is 1) The return command automatically limits the number of incoming events with the “head” command and the resulting fields with the “fields” command. Generally it’s a procedure of adding condition dynamically to your main search. A sub search looks for a single piece of information that is then added as a criteria, to the main search. “Sub search” in Splunk – A sub search is a search within a primary search. Search B: use the src_hostname field found in Search A and search index=wineventlog src_hostname=$src_hostname$ and output the Logon_User field from the wineventlog index to the final table.“Return” command basically returns the result from the sub search to your main search.

#SPLUNK SUBSEARCH BASED ON RESULTS MAC#

| rename newTime AS 'Last DHCP Request',src_hostname AS 'Source Hostname',src_mac AS 'Source MAC Address' Search A: index=infoblox sourcetype='infoblox:dhcp' src_ip=10.10.10.10 dhcp_type=DHCPREQUEST What are my options here? I've tried using chart but searching the entire infoblox and wineventlog indexes and then filtering down didn't seem to work well as they are too high volume. I was able to do this with a join but kept running into the 50,000 line limit causing the wineventlog results to show up sporadically. I want to add a subsearch that then searches index=wineventlog and returns the Logon_Account and uses the src_hostname field as the common field to match on. The search then display's a table with the time, Source Hostname and Source Mac address, all pulled from the infoblox index. I have a single search that allows users to enter an IP address and return the workstation hostname that was associated to the IP address during a specific time frame in DHCP.

Splunk subsearch based on results