If instead you have a positive filter and you want to have also some fields from the lookup, it's easier to use lookup with a following search command.

If you have to implement a positive filter () and you don't need to use the other fields of the lookup to enrich results, you can use inputlookup In this section, we are going to learn about the Sub-searching in the Splunk platform. If you want to implement an exclusion filter (NOT ) it's better to use inputlookup. Hi, I need a way to check if a value is in a sub search table result. Solution StephenSorkin Splunk Employee 09-24-2010 08:38 PM You can use the fact that a subsearch will render the 'query' field literally. One or more of the fields must be common to each result set. It's very common for people to gravitate to complex joins and subsearches and overlook a simpler way to do the same thing with stats. The join command is used to combine the results of a sub search with the results of the main search. search transactionid'1' So in our example, the search that we need is. | search one_lookup_field_not_present_in_the_main_search=* sourcetypeA OR sourcetypeB stats values (sourcetype) as sourcetypes by SERIALNUMBER search sourcetypes'B' table SERIALNUMBER. In your Splunk search, you just have to add.

If you want to filter results of the main search it's better to use inputlookup, index=your_index īut it's also possible to use lookup with a following search command. Inputlookup is used in the main search or in subsearches. Hi command is used to enrich results with the content of the lookup joining them with the main search results.

Splunk sub search