topic Re: How to search a field for values that are stored in another field? in Splunk Search

How to search a field for values that are stored in another field?

macoo — Wed, 18 May 2016 13:18:49 GMT

Hi,

Can you please help me with the following case? I'm trying to use the value of a field to search within the values of another field. The search is as follows and it does not work:

index = dummy | eval FieldA=case(...) | search FieldB=FieldA

Output: it should return the rows whose FieldB equals FieldA.

It doesn't seem difficult, but Splunk cannot handle that.

Thanks

Re: How to search a field for values that are stored in another field?

somesoni2 — Wed, 18 May 2016 14:25:39 GMT

Your question title says subsearch and I don't see a subsearch in your example query. Could you provide the actual query that you're trying run (mask anything sensitive, just want to look at the eval of FieldA and usage of it in "subsearch")

Re: How to search a field for values that are stored in another field?

macoo — Wed, 18 May 2016 14:32:13 GMT

By the subsearch, I mean "| search FieldB = FieldA". A general problem is that I find it impossible to search a partiular field, e.g. FieldA for values that are stored in Field B. Do you see my point?

Re: How to search a field for values that are stored in another field?

macoo — Wed, 18 May 2016 14:33:35 GMT

Another example:

index=veryBigIndex | eval valueContainer="dummyUser" | search UserList=valueContainer

Re: How to search a field for values that are stored in another field?

macoo — Wed, 18 May 2016 14:34:13 GMT

So, find users that are called "dummyUser"

Re: How to search a field for values that are stored in another field?

sundareshr — Wed, 18 May 2016 15:22:17 GMT

Try the where command. Like this .. | where fieldA=fieldB

Re: How to search a field for values that are stored in another field?

Akumar294 — Thu, 27 Sep 2018 11:14:47 GMT

Hello Macoo,

Were you able to arrive at a solution, i have a similar problem:

Please first read case 2- it gives me the desired result but case 1 fails.
my job number changes everyday but it remains unique for the same day, i am trying to automate the search so that same search is valid for second day and all other days.
Basically i am looking for the completion status of Job number based on certain parameters that are defined in my search, please let me know for further inputs.

Flow goes like : searching whole data-->extracting job number-->searching for my required data-->storing the desired job_number into my own variable using eval-->appending a new search which will append the whole event again, then further used pipe to search for my specific data.