title: Splunk query based on the results of another query
body: <p>A Splunk question...</p>
  
  <p>I've found a few Google hits that I thought were going to help with this.  I'm trying to perform a search for all "rows" that are returned by an outer search/query.</p>
  
  <p>I am by no means a Splunk expert, not even a power user!</p>
  
  <p>The outer query performs an LDAP search against Active Directory and returns a list of people with a particular group membership (e.g.: all Domain Admins or Account Operators, Etc.)</p>
  
  <p>I then want to perform a search for each of the returned user names against Windows Event Logs … and return the results as one data set.</p>
  
  <p>I've got the LDAP search nailed.  I've got the Windows Event Log search nailed.  I just need to stitch them together.</p>
  
  <p>If I were coding this in a script, I'd either:</p>
  
  <p>i) Enumerate relevant group members into an array.  Run the event log query for users that exist in the array, e.g.: using semantics such as isin() or contains(); or
  ii) Enumerate the group members and perform a foreach() type loop. </p>
  
  <p>So, how the #?!@ do I do this in Splunk.  I've tried using the "search" command and "foreach" command, but have had no joy.  I even toyed with building a lookup and tried isin(), but could not get this to work.</p>
  
  <p>Example LDAP search:</p>
  
  <pre><code>| ldapsearch domain="contoso.com" search="(&amp;(objectclass=user)(objectCategory=person)(memberOf=CN=Domain Admins,OU=MyContainer,DC=contoso,DC=com))" attrs="sAMAccountName" basedn="DC=contoso,DC=com" | eval ldapSearchUserName="contoso\\"+lower(sAMAccountName)
  </code></pre>
  
  <p>Example Event log search:</p>
  
  <pre><code>index="wineventlog" source="WinEventLog:Security" sourcetype="WinEventLog:Security" "LogName=Security" "EventCode=4624" earliest=-1d | rex field=Message ".*Logon Type:\s+(?&lt;LogonType&gt;\d+)" | eval UserName=mvindex(Security_ID, 1) | table UserName
  </code></pre>
  
  <p>Any thoughts, hints or guidance?</p>
  
  <p>Many thanks</p>
  
  <p>S</p>