https://community.splunk.com/t5/Splunk-Search/How-can-I-inject-all-rex-field-events-from-1st-search-to-2nd/m-p/642878#M222657 <P>Please can you provide more details on what you have so far as your description is a little vague and confusing?</P> Wed, 10 May 2023 15:46:48 GMT ITWhisperer 2023-05-10T15:46:48Z https://community.splunk.com/t5/Splunk-Search/How-can-I-inject-all-rex-field-events-from-1st-search-to-2nd/m-p/642868#M222653 <P>I am planning to build a dashboard where all the extracted traceId # are collected and injected to another search criteria where only the extracted traceId # from 1st search is passed to 2nd search and have a results, total count for the 1st search and total count for second search only with those regex traceId.</P> <P>I used the drop down and used regex but when passing the token, I.m selecting all the traceId where it passes as * in second search which is searching all not from the 1st search.</P> <P>is there a way to inject the 1st searched traceId to 2nd search ?&nbsp;</P> Thu, 11 May 2023 02:07:41 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-inject-all-rex-field-events-from-1st-search-to-2nd/m-p/642868#M222653 mikeyty07 2023-05-11T02:07:41Z https://community.splunk.com/t5/Splunk-Search/How-can-I-inject-all-rex-field-events-from-1st-search-to-2nd/m-p/642878#M222657 <P>Please can you provide more details on what you have so far as your description is a little vague and confusing?</P> Wed, 10 May 2023 15:46:48 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-inject-all-rex-field-events-from-1st-search-to-2nd/m-p/642878#M222657 ITWhisperer 2023-05-10T15:46:48Z https://community.splunk.com/t5/Splunk-Search/How-can-I-inject-all-rex-field-events-from-1st-search-to-2nd/m-p/643074#M222755 <P>i want to trace logs for specific api that runs in sequence for specific transsaction.<BR />like&nbsp; api/search/brand--&gt; api/buy/gucci --&gt; api/gucci/custom --&gt;api/purchased. and these logs have one field in common TrackingID. Is there a way to get all these logs events in table for total count of the api searched for api/search/clothes and the TrackingID from the first api to the second&nbsp; api/buy/gucci total count and so on.<BR /><BR /></P><P>2023-05-11T15:06:14 TrackingID =abcdgucci123 duration=600 uri="/api/search/brand" source=xyz<BR /><BR />2023-05-11T15:06:15 TrackingID =abcdgucci123 duration=500 uri="/api/buy/gucci" source=brb</P><P>2023-05-11T15:06:16 TrackingID =abcdgucci123 duration=500 uri="/api/gucci/custom" source=idk</P><P>2023-05-11T15:06:17 TrackingID =abcdgucci123 duration=500 uri="/api/purchased" source=abc<BR /><BR />this is just an example of logs there would be hunderds of these logs. Is there a way to get count of all api in table for the count of api called and so on through the&nbsp;TrackingID to the next api being called?</P> Thu, 11 May 2023 15:39:13 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-inject-all-rex-field-events-from-1st-search-to-2nd/m-p/643074#M222755 mikeyty07 2023-05-11T15:39:13Z https://community.splunk.com/t5/Splunk-Search/How-can-I-inject-all-rex-field-events-from-1st-search-to-2nd/m-p/643076#M222756 <P>Do you mean</P><LI-CODE lang="markup">| stats count by TrackingID uri</LI-CODE> Thu, 11 May 2023 15:51:38 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-inject-all-rex-field-events-from-1st-search-to-2nd/m-p/643076#M222756 ITWhisperer 2023-05-11T15:51:38Z