topic Re: How to use a rex field in another search in Splunk Search

How to use a rex field in another search

irvindominguezs — Tue, 20 Apr 2021 18:53:00 GMT

I am trying the following query. However, activityId is not being passed to the second query and I am not having any results.

index=kubernetes lineOfBusiness=ifm component=chub useCase=C5 responsePayload
| rex field=_raw "imsiActivationDate\"\:\"(?<imsiActivationDate>[^\"]*)"
| rex field=_raw "simChangeDate\"\:\"(?<simChangeDate>[^\"]*)"
| rex field=_raw "activity-id=(?<activityId>[^||]*)"
| table activityId | map search="index=kubernetes lineOfBusiness=ifm component=ifm activity-id=*$activityId$*" | rex field=_raw "msisdn":"=(?<msisdn>[^=]*)" | dedup activityId, msisdn
| table activityId msisdn

Re: How to use a rex field in another search

manjunathmeti — Tue, 20 Apr 2021 21:13:30 GMT

hi @irvindominguezs,

Instead of using the map command, you can use the first/main search as a sub search to filter activityId in the second search.

index=kubernetes lineOfBusiness=ifm component=ifm activity-id IN([| search index=kubernetes lineOfBusiness=ifm component=chub useCase=C5 responsePayload | rex field=_raw "activity-id=(?<activityId>[^||]*)" | eval activityId="*".activityId."*" | stats values(activityId) as re | return $re]) | rex field=_raw "msisdn":"=(?<msisdn>[^=]*)" | dedup activityId, msisdn | table activityId msisdn

If this reply helps you, a like would be appreciated.

Re: How to use a rex field in another search

irvindominguezs — Tue, 20 Apr 2021 21:25:07 GMT

Hello,

It did not work. I am still getting 0 results.

Re: How to use a rex field in another search

scelikok — Wed, 21 Apr 2021 05:49:14 GMT

Hi @irvindominguezs,

Can you try below?

index=kubernetes lineOfBusiness=ifm component=chub useCase=C5 responsePayload | rex field=_raw "imsiActivationDate\"\:\"(?<imsiActivationDate>[^\"]*)" | rex field=_raw "simChangeDate\"\:\"(?<simChangeDate>[^\"]*)" | rex field=_raw "activity-id=(?<activityId>[^||]*)" | table activityId | map search="search index=kubernetes lineOfBusiness=ifm component=ifm activity-id=*$activityId$*" | rex field=_raw "msisdn":"=(?<msisdn>[^=]*)" | dedup activityId, msisdn | table activityId msisdn