topic Re: Use extracted field in a subsearch in Splunk Search

Use extracted field in a subsearch

kochera — Tue, 05 Apr 2011 13:36:29 GMT

Hi,

I would like to combine two searches. The first one gives me the session-id which i would like to use in a second search, e.g.

Query 1: index=main 123.123.123.156 source="/appl/log/www/access.log" |rex field=raw "\"\s\"(?[A-z,0-9,-.]+)"

Query 2: index=main $SessionID$ source="/appl/log/www/access.log"

Cheers, Andy

Re: Use extracted field in a subsearch

MuS — Tue, 05 Apr 2011 17:21:17 GMT

Hi kochera

you could use something like that (I used a different regex for this example!):

index="main" 123.123.123.156 source="/appl/log/www/access.log" [search index="main" source="/appl/log/www/access.log" | rex field=_raw "(?i)^(?:[^-]*-){5}\s+(?P.+)" | fields requestid ]

the sub search will result in a list of:

( ( requestid="xxxxxxxxxxxxxxxxx" ) OR ( requestid="xxxxxxxxxxxx" ) OR ( requestid="xxxxxxxxx" ) )

and this will be used in the search.

hope this helps

MuS

Re: Use extracted field in a subsearch

kochera — Tue, 05 Apr 2011 18:07:12 GMT

Hi, thanks for your answer. I'm not sure if this gives me the correct result. I would like to check if the same SessionID is used with a different IP-Adress.

Re: Use extracted field in a subsearch

MuS — Tue, 05 Apr 2011 18:41:49 GMT

well then just leave the IP away in the main search, then you should see any SessionID of any IP.

Re: Use extracted field in a subsearch

kochera — Tue, 05 Apr 2011 18:53:30 GMT

yes, that's what I'm trying at the moment

index=main source="/appl/log/www/access.log" [search index=main source="/appl/log/www/access.log" "123.123.123.156" |rex field=raw "\"\s\"(?[A-z,0-9,-.]+)"| fields + sessionid]

But somehow I don't get any results...

Re: Use extracted field in a subsearch

MuS — Tue, 05 Apr 2011 19:36:15 GMT

okay leave the IP completely away in any search; but then I wonder why are you using a sub search anyway?

Re: Use extracted field in a subsearch

kochera — Tue, 05 Apr 2011 19:51:14 GMT

if I leave the IP away, then I see results but as you mentioned, this doesn't make any sense...