Splunk Search

Deriving one event from another

akki2428
New Member

Hi, pardon if my question is too obvious, am a Splunk noob.
My requirement is:
I have a search String , example "Error occured in getting ID....". In the result log of this search is included a unique ID (there are multiple logs for each time that searh string is matched, unique ID different for all such logs).
I want to further search for one specific log that has same unique ID plus some other text.

E.g - This is search string query:

index=index "Error finding xID for ID:" | dedup uniquId

This is one block of the result:

{"level":"ERROR","uniqueId":"48b3825e993981df25d13670 1", "message":"Error finding xID for ID:1234"}

What I require is, to be able to further search based on uniqueId in log dynamcially.
E.g:

| <uniqueId> "some other search string"
Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

some other search string AND [ search index=index "Error finding xID for ID:" | dedup uniquId | table uniquId ]
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner   Watch on demand us for a demo-driven ...

The Data Connection - October 2026

We all have data. Lots of it. But that’s not the problem – it’s understanding what we should we do with it, ...

Beyond the Acceleration Zone: Maximizing Your Success with Splunk Customer Experience ...

Customer success is built on tailored guidance and accessible resources. As a Splunk user, you are encouraged ...