<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Need to pipe values with out using sub search in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Need-to-pipe-values-with-out-using-sub-search/m-p/180116#M51859</link>
    <description>&lt;P&gt;I didn't quite get the article. Can you explain how i can achieve in the examples I asked for?&lt;/P&gt;</description>
    <pubDate>Tue, 05 May 2015 05:02:49 GMT</pubDate>
    <dc:creator>splunknewbie05</dc:creator>
    <dc:date>2015-05-05T05:02:49Z</dc:date>
    <item>
      <title>Need to pipe values with out using sub search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Need-to-pipe-values-with-out-using-sub-search/m-p/180114#M51857</link>
      <description>&lt;P&gt;I have a search that returns values using stats command which needs to be piped to do another search&lt;/P&gt;

&lt;P&gt;index=myindex1  sourcetype=“source1”  mymessage=“Helloworld” | stats values(id) as ID &lt;/P&gt;

&lt;P&gt;Assuming that ID now contains all unique id values&lt;/P&gt;

&lt;P&gt;Now I need to use these ID values and perform another search in a different source type.  Is it possible to do this with out having to use sub search&lt;/P&gt;

&lt;P&gt;Lets  say the following query gives id values as 1, 2, 5, 6, 7.&lt;/P&gt;

&lt;P&gt;index=myindex1  sourcetype=“source1”  mymessage=“Helloworld” | stats values(id) as ID &lt;/P&gt;

&lt;P&gt;Now I need to do search  search for mymessage=“Foo” in sourcetype=“source2” where  values in (1,2,5,6,7)&lt;/P&gt;

&lt;P&gt;How can we do this with out using sub search?&lt;/P&gt;</description>
      <pubDate>Tue, 05 May 2015 01:28:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Need-to-pipe-values-with-out-using-sub-search/m-p/180114#M51857</guid>
      <dc:creator>splunknewbie05</dc:creator>
      <dc:date>2015-05-05T01:28:58Z</dc:date>
    </item>
    <item>
      <title>Re: Need to pipe values with out using sub search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Need-to-pipe-values-with-out-using-sub-search/m-p/180115#M51858</link>
      <description>&lt;P&gt;Refer to &lt;A href="http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html"&gt;this&lt;/A&gt; post&lt;/P&gt;</description>
      <pubDate>Tue, 05 May 2015 03:19:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Need-to-pipe-values-with-out-using-sub-search/m-p/180115#M51858</guid>
      <dc:creator>ramdaspr</dc:creator>
      <dc:date>2015-05-05T03:19:25Z</dc:date>
    </item>
    <item>
      <title>Re: Need to pipe values with out using sub search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Need-to-pipe-values-with-out-using-sub-search/m-p/180116#M51859</link>
      <description>&lt;P&gt;I didn't quite get the article. Can you explain how i can achieve in the examples I asked for?&lt;/P&gt;</description>
      <pubDate>Tue, 05 May 2015 05:02:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Need-to-pipe-values-with-out-using-sub-search/m-p/180116#M51859</guid>
      <dc:creator>splunknewbie05</dc:creator>
      <dc:date>2015-05-05T05:02:49Z</dc:date>
    </item>
    <item>
      <title>Re: Need to pipe values with out using sub search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Need-to-pipe-values-with-out-using-sub-search/m-p/180117#M51860</link>
      <description>&lt;P&gt;I didn't quite get the article. Can you explain how i can achieve in the examples I asked for?&lt;/P&gt;</description>
      <pubDate>Tue, 05 May 2015 05:30:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Need-to-pipe-values-with-out-using-sub-search/m-p/180117#M51860</guid>
      <dc:creator>splunknewbie05</dc:creator>
      <dc:date>2015-05-05T05:30:17Z</dc:date>
    </item>
  </channel>
</rss>

