Splunk Search

Filtering data using a second query

jacu86
Engager

I have data in two different applications. I need to get fields from one query to use as filters for another, like this:

```
app=app1 | rex field=environment_url "https:\/\/(?<app_name>.*)\.foo\.com" | where app_name in [ search app=app2 | table app_name ]
```

app2 has a field named app_name which I'm turning into a table. app1 doesn't have this field, but I'm creating and extracting it with a regex. 

I only want the app names from app1 if they exist in the table I'm creating from app2. This query isn't working for me, what can I do? Thank you for any help.

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jacu86 ,

there's only one attention point: the field used for the filtering must be the same in main and sub search:

app=app1 
| rex field=environment_url "https:\/\/(?<app_name>.*)\.foo\.com" 
| search [ search app=app2 | fields app_name ]

if not, you have to rename it.

One additional hint: use always the index= filter to have faster searches.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @jacu86 ,

there's only one attention point: the field used for the filtering must be the same in main and sub search:

app=app1 
| rex field=environment_url "https:\/\/(?<app_name>.*)\.foo\.com" 
| search [ search app=app2 | fields app_name ]

if not, you have to rename it.

One additional hint: use always the index= filter to have faster searches.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...