How to join where a macro is used in the search?

[POR160893]

Hi,

On Splunk, I have a macro called `ABC` . I use this macro in the first search like this:
`ABC`
| stats values(src_ip) values(src_zone) values(dest_ip) values(dest_port) values(app) values(transport) values(session_end_reason) by host rule action
| rename values(*) as *
| rex field=host "(?<host_new>[^\.]+?)(?:\.[01]|\.02)?\."
I also have a second Splunk search as follows:
| rex field=Device_FQDN "(?<Device_FQDN>[^\.]+?)(?:\.[01]|\.02)?\."
I need to JOIN BOTH searches using the field "host_new" from the first search and the field "Device_FQDN" from the second search as the common fields to perform the JOIN on.
What would the Splunk query be in this case, using both searches I have supplied and where the first search uses a macro?


Many thanks,
P

[TrangCIC81]

can you try something like this?

(index=<your_index> <your_first_search> | `ABC`
| stats values(src_ip) values(src_zone) values(dest_ip) values(dest_port) values(app) values(transport) values(session_end_reason) by host rule action
| rename values(*) as *
| rex field=host "(?<host_new>[^\.]+?)(?:\.[01]|\.02)?\.") 
| join host_new [| <your_second_search> | rex field=Device_FQDN "(?<Device_FQDN>[^\.]+?)(?:\.[01]|\.02)?\." | fields Device_FQDN host_new]

 Using the join command to join the first search with the second search.  

[POR160893]

I have already provided you with the first and second searches, though. The first search is:
`palo_logs(traffic)`
| stats values(src_ip) values(src_zone) values(dest_ip) values(dest_port) values(app) values(transport) values(session_end_reason) by host rule action
| rename values(*) as *
| rex field=host "(?<host_new>[^\.]+?)(?:\.[01]|\.02)?\."

and the second search is:
| rex field=Device_FQDN "(?<Device_FQDN>[^\.]+?)(?:\.[01]|\.02)?\."


So, what would the join look like?