topic Re: how do I use regular expression search results from one index search and use it in another? in Splunk Search

how do I use regular expression search results from one index search and use it in another?

krishna81m — Tue, 29 Sep 2020 08:30:46 GMT

How do I use regular expression search results from one index search and use it in another? The following does not work

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | fields my_nonce]

I followed this example at https://answers.splunk.com/answers/65336/how-do-i-use-the-output-from-one-serch-as-input-to-another.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev

index=other_index [search index=ironmail some_search_string | fields email_address ]

Re: how do I use regular expression search results from one index search and use it in another?

esix_splunk — Sat, 23 Jan 2016 06:56:10 GMT

You can try

 host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" |return my_nonce]

You can also modify this a bit to use return $my_nonece, and modify the search to be

host="*rest*" my_nonce=[ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" |return $my_nonce]

Using $ will return the actual value, where as return itself will throw back the full field.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Return

Be aware of the behavior of return, as it uses head to return the first result.

Re: how do I use regular expression search results from one index search and use it in another?

somesoni2 — Tue, 29 Sep 2020 08:30:49 GMT

Does your main search has a field called my_nonce?? If yes then your source should work fine (provided subsearch works fine). If there is no my_nonce field and you want to do a text search try this.

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | stats count by my_nonce | table my_nonce | rename my_nonce as search ]

Re: how do I use regular expression search results from one index search and use it in another?

Murali2888 — Mon, 25 Jan 2016 02:41:24 GMT

You can use the below as well.

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | rename my_nonce as query | fields query]

For example, if my_nonce has values like foo and bar, the query will return

host=*rest*  "foo" OR "bar"

Re: how do I use regular expression search results from one index search and use it in another?

Murali2888 — Wed, 03 Feb 2016 05:18:42 GMT

Can you accept if either of the answers worked for you?