Comparing 2 Atrributes in different indexes

[shinobu]

I have stored data in 2 indexes. One Index has a attribute which can be a substring of the second index _raw event data format. I want to generate a List for every substring that was found inside that row event. Any ideas how i can accomplish this? Thank you.

I tried something like: 

index="index2" | rename _raw as raw | map search="search index=\"index1\" | where like($raw$,\"%\".field1.\"%\")" 

For some reason there is no field "result" in my output.

[venkatasri]

Hi @shinobu 

Subquery might work in your case, 

index=index2  [search index=index1 | fields your_attribute_field | rename your_attribute_field as search]

With above query the events from index2 getting filtered only having your required attribute.

----------------------------------------------

An upvote would be appreciated if it helps!

[maciep]

Not entirely sure if i understand what you're after, but from what I can gather, I think I would go the opposite away - get the field values, then map those into a search of index2.  Something like below maybe?  The regex could change depending on your definition of "substring".

Also if you just wanted the events that match in general (and not needing the actual substrings), a simple subsearch may be better, not sure.

index=index1 | stats count by field1 
| map search="search index=\"index2\" | rex max_match=0 \"(?i)(?<substrings>\w*$field1$\w*)\""
| where isnotnull(substrings)
| table substrings, _raw