Deriving one event from another

akki2428 — Tue, 31 Mar 2020 05:54:31 GMT

Hi, pardon if my question is too obvious, am a Splunk noob.
My requirement is:
I have a search String , example "Error occured in getting ID....". In the result log of this search is included a unique ID (there are multiple logs for each time that searh string is matched, unique ID different for all such logs).
I want to further search for one specific log that has same unique ID plus some other text.

E.g - This is search string query:

index=index "Error finding xID for ID:" | dedup uniquId

This is one block of the result:

{"level":"ERROR","uniqueId":"48b3825e993981df25d13670 1", "message":"Error finding xID for ID:1234"}

What I require is, to be able to further search based on uniqueId in log dynamcially.
E.g:

| <uniqueId> "some other search string"

Re: Deriving one event from another

woodcock — Tue, 31 Mar 2020 06:07:15 GMT

Like this:

some other search string AND [ search index=index "Error finding xID for ID:" | dedup uniquId | table uniquId ]

topic Deriving one event from another in Splunk Search

Deriving one event from another

Re: Deriving one event from another