topic Re: How to create a query using values that come from the result of a different query in Splunk Search

How to create a query using values that come from the result of a different query

HomelessMonkey — Tue, 25 Aug 2015 20:58:27 GMT

Hello,

So I'm logging xml requests and responses as raw strings into splunk. To get the responses searching, among other things, the following string:

 >response</

This results of this will have a value that will help me link them to the request associated to that response. My question is, how can I search for the requests associated to those specific results.

So for example, my first query returns 100 responses with different unique "RequestID", how do i find the 100 requests that have that "RequestID".

Thanks

Re: How to create a query using values that come from the result of a different query

somesoni2 — Tue, 25 Aug 2015 22:45:42 GMT

Assuming you have the field RequestID extracted for both Request and Response XML data, try something like this

your base search to get request xml  [search your base search to get Response xml | table RequestID ] | rest of the search

THe subsearch will get list of RequestID and make a giant OR condition , which will filter the data from your base search which is for Requests.
Update
Try something like this

your base search to get Response XML | rex field=_raw "requestID\>(?<RequestId>[^\<])" |  eval search="requestID\>".RequestId | table search] | rest of the search

Re: How to create a query using values that come from the result of a different query

HomelessMonkey — Tue, 25 Aug 2015 23:22:06 GMT

Sadly the whole thing is just a raw string so it's more like:

[rest of the xml]<requestId>value</requestid>..[rest of the xml]

Re: How to create a query using values that come from the result of a different query

HomelessMonkey — Wed, 26 Aug 2015 19:45:55 GMT

I just tried your Updated code as suggested and I'm getting parser errors. Trying to look up in the documentation, just to be sure my query is looking something like this

responseQuery | rex field=_raw "requestID\>(?<RequestId>[^\<])" |  eval search="requestID\>".RequestId | table search] | requestQuery

Getting a "mismatched ]" error (guessing it is the one after search. When removing it, it tries to parse the query as a command. Thanks so much for the help so far, I'm not used to performing this kind of queries.

Re: How to create a query using values that come from the result of a different query

somesoni2 — Wed, 26 Aug 2015 19:56:41 GMT

If you can post sample query using which you're getting response data and request data (two separate queries), I can help you translate this correctly.

Re: How to create a query using values that come from the result of a different query

HomelessMonkey — Wed, 26 Aug 2015 22:22:53 GMT

Request: [environment name] ">request</" ProcessXmlStream
Response: ">response</" [Error code]