topic Re: How to pass a value extracted from a main search to a sub search from different source? in Splunk Search

How to pass a value extracted from a main search to a sub search from different source?

vivek991985 — Mon, 12 Aug 2019 14:47:02 GMT

Example:

source="FILE1.log" search_input | rex ".*]*Rpc id :(?[0-9][0-9][0-9][0-9][0-9][0-9])" | append [search source ="FILE2.log" rpc_id]

Re: How to pass a value extracted from a main search to a sub search from different source?

Sukisen1981 — Mon, 12 Aug 2019 16:24:59 GMT

Hi @vivek991985
You can't pass a value from a main search to a sub search, it works the other way round.
That being said and from what I can understand try something like this -

source ="FILE2.log"  | eval id=[search  source="FILE1.log" search_input | rex ".*]*Rpc id :(?[0-9][0-9][0-9][0-9][0-9][0-9])" |return $rpc_id]

Basically, the eval gets executed first and whatever rex you are performing (assuming the rex works) gets assigned o the field id, you can then pipe on and do what you need with file2log source

Re: How to pass a value extracted from a main search to a sub search from different source?

vivek991985 — Mon, 12 Aug 2019 17:33:03 GMT

Thank you @Sukisen1981