Can you help me with the following Splunk search query?

[jafarmat]

Hi,

So i'm having this rule...

  index=logs sourcetype=console_test_1 "[Status] Discovered" 
    | rex "<regex rule>" | table orderId 

...that outputs me a column with IDs. What i want to do is something like getting these IDs and using them in another search, which results i want to append to the one above. The second result is from another source type.

So, something like this:

  index=logs sourcetype=console_test_1 "[Status] Discovered" 
    | rex "<regex rule>" | table orderId ->  sourcetype=console_test_2 <orderId> | rex "<regex rule2>" | table result2 -> join column

I've search the net but haven't figured it out yet.

Thank you

[mstjohn_splunk]

hi @jafarmat,

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

[richgalloway]

I believe you want a subsearch. Subsearch results are passed to and become part of the main search.

See if this gets you going in the right direction.

sourcetype=console_test_2 [index=logs sourcetype=console_test_1 "[Status] Discovered" 
 | rex "<regex rule>" | fields orderId | format] | rex "<regex rule2>" | table result2

[jafarmat]

The thing is that i need the results(only one column) from let s say regex rule 2 so i can use them in regex rule1.I know about subsearches but i ve never seen one done in this manner

[richgalloway]

You may need to be more specific about using the results of regex rule 2 in regex rule 1 as that is pretty much what this search does. It uses regex rule 1 to return a set of results that are then searched by regex rule 2.