Hi,
I need to call the result value as a filter. like this table below, the second value on column RecipientDomain will call on search as filter. become this query:
index=sec_office365_dlp sourcetype=sec_office365_dlp RecipientDomain=@yahoo.com | stats count by xxx
Help please..
You need a subsearch. The subsearch runs first and selects the value the main search will look for.
index=sec_office365_dlp sourcetype=sec_office365_dlp [ index=sec_office365_dlp sourcetype=sec_office365_dlp RecipientDomain IN (@gmail.com @yahoo.com @hotmail.com)
| stats count by RecipientDomain
| sort limit=2 - count
| tail 1
| return RecipientDomain ]
| stats count by xxx
The subsearch selects the last (tail 1) result from the two produced by sort, which is the same as the second of three.
How does Splunk know which RecipientDomain value to use? Is it always the second?
Yes @richgalloway , we always use the second one value.
You need a subsearch. The subsearch runs first and selects the value the main search will look for.
index=sec_office365_dlp sourcetype=sec_office365_dlp [ index=sec_office365_dlp sourcetype=sec_office365_dlp RecipientDomain IN (@gmail.com @yahoo.com @hotmail.com)
| stats count by RecipientDomain
| sort limit=2 - count
| tail 1
| return RecipientDomain ]
| stats count by xxx
The subsearch selects the last (tail 1) result from the two produced by sort, which is the same as the second of three.