|
Hi, I want to use the search results as an argument for another search (with different source), like this more or less...: source=/var/log/remots/ns_traffic.log dst=[search sourcetype="snort" | fields dest_ip] Is this possible? Which is the right way to do it? Thanks in advance, Alex |
3 Answers:
You can also take a look on the search restriction created by the subsearch by executing this search: |
|
Hi Ziegfried! The search: source=/var/log/remots/ns_traffic.log [search sourcetype="snort" | fields dest_ip | rename dest_ip as dst] worked better than mine... ;) i think that the main thing was on the rename command, which tells splunk to match the different fields, isn't it? thanks! Alex |