first query table output as input to another query

vadlamudi — Wed, 06 Oct 2021 20:57:46 GMT

Hello,

Can i please know how to parse the value to the 2nd query from the output of 1st query. Any help would be appreciated.

1st query:

index=<index_name> sourcetype=<sourcetype_name> | table k8s_label | where k8s_label="id=<id_number>"

1st Query Output:

name=peter

project_id=123

user_id=2700835661

zone=us-west-2a

2nd Query:

index=<index_name> "server failed" Project_id=<need to get project_id from the result of 1st query Output>

Thanks

Re: first query table output as input to another query

bowesmana — Wed, 06 Oct 2021 21:36:18 GMT

From your description it looks like your k8s_label is a field containing 4 lines of data, each line represents a field of its own. However, your where statement in your first query references 'id=<xxx>" where there is no id= component in that text.

What do you want as your final output?

However, in terms of using one query to filter another you can use a subsearch, e.g.

index=<index_name> "server failed" [ search index=<index_name> sourcetype=<sourcetype_name> | rex field=k8s_label "(?s)project_id=(?<Project_id>\d+)" | fields Project_id ]

which will use the Project_id from the subsearch as a filter to the outer search for server failed, but I am not clear if this is what you need. Can you clarify your data and expected output.

topic Re: first query table output as input to another query in Splunk Search

first query table output as input to another query

Re: first query table output as input to another query