Splunk Search

Deriving one event from another

akki2428
New Member

Hi, pardon if my question is too obvious, am a Splunk noob.
My requirement is:
I have a search String , example "Error occured in getting ID....". In the result log of this search is included a unique ID (there are multiple logs for each time that searh string is matched, unique ID different for all such logs).
I want to further search for one specific log that has same unique ID plus some other text.

E.g - This is search string query:

index=index "Error finding xID for ID:" | dedup uniquId

This is one block of the result:

{"level":"ERROR","uniqueId":"48b3825e993981df25d13670 1", "message":"Error finding xID for ID:1234"}

What I require is, to be able to further search based on uniqueId in log dynamcially.
E.g:

| <uniqueId> "some other search string"
Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

some other search string AND [ search index=index "Error finding xID for ID:" | dedup uniquId | table uniquId ]
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Splunk Observability Metrics Cost Optimization

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...