https://community.splunk.com/t5/Splunk-Search/Multisearch/m-p/358950#M170013 <P>Could you please try like this</P> <P>index=wineventlogs action=delete<BR /> | rex field=_raw "GID : (?.*)"<BR /> | table _time, ID | join ID | [ Search "your query" | table ID, "any values you want" ] | table table _time, ID,"any values you want"</P> <P>or</P> <P>index=wineventlogs action=delete<BR /> | rex field=_raw "GID : (?.*)"<BR /> | table _time, ID | append | [ Search "your query" | table ID, "any values you want" ] | table table _time, ID,"any values you want"</P> <P>Please refer the below document.it will help you<BR /> for append<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Append">http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Append</A></P> Tue, 24 Apr 2018 16:47:38 GMT logloganathan 2018-04-24T16:47:38Z https://community.splunk.com/t5/Splunk-Search/Multisearch/m-p/358949#M170012 <P>Is there a way to have if you extract data from a search to have it fun in another search? Like putting the field value into another search without having to manually type or script it out?</P> <P>Example:</P> <P>index=wineventlogs action=delete<BR /> | rex field=_raw "GID : (?.*)"<BR /> | table _time, ID<BR /> | (NEW Search) "ID" (how would I get that to populate)</P> <P>Would I have to do a multisearch??</P> <P>Thanks for the help.</P> Tue, 24 Apr 2018 16:34:32 GMT https://community.splunk.com/t5/Splunk-Search/Multisearch/m-p/358949#M170012 HealyManTech 2018-04-24T16:34:32Z https://community.splunk.com/t5/Splunk-Search/Multisearch/m-p/358950#M170013 <P>Could you please try like this</P> <P>index=wineventlogs action=delete<BR /> | rex field=_raw "GID : (?.*)"<BR /> | table _time, ID | join ID | [ Search "your query" | table ID, "any values you want" ] | table table _time, ID,"any values you want"</P> <P>or</P> <P>index=wineventlogs action=delete<BR /> | rex field=_raw "GID : (?.*)"<BR /> | table _time, ID | append | [ Search "your query" | table ID, "any values you want" ] | table table _time, ID,"any values you want"</P> <P>Please refer the below document.it will help you<BR /> for append<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Append">http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Append</A></P> Tue, 24 Apr 2018 16:47:38 GMT https://community.splunk.com/t5/Splunk-Search/Multisearch/m-p/358950#M170013 logloganathan 2018-04-24T16:47:38Z https://community.splunk.com/t5/Splunk-Search/Multisearch/m-p/358951#M170014 <P>I tried this but didn't work. I am trying to get the rex ID created field to be part of the new search but errors out.</P> Tue, 24 Apr 2018 19:29:57 GMT https://community.splunk.com/t5/Splunk-Search/Multisearch/m-p/358951#M170014 HealyManTech 2018-04-24T19:29:57Z https://community.splunk.com/t5/Splunk-Search/Multisearch/m-p/358952#M170015 <P>do you want regex expression? i have provided example which tells how to do multisearch</P> Wed, 25 Apr 2018 09:16:25 GMT https://community.splunk.com/t5/Splunk-Search/Multisearch/m-p/358952#M170015 logloganathan 2018-04-25T09:16:25Z