Splunk Search

Filtering data using a second query

jacu86
Engager

I have data in two different applications. I need to get fields from one query to use as filters for another, like this:

```
app=app1 | rex field=environment_url "https:\/\/(?<app_name>.*)\.foo\.com" | where app_name in [ search app=app2 | table app_name ]
```

app2 has a field named app_name which I'm turning into a table. app1 doesn't have this field, but I'm creating and extracting it with a regex. 

I only want the app names from app1 if they exist in the table I'm creating from app2. This query isn't working for me, what can I do? Thank you for any help.

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jacu86 ,

there's only one attention point: the field used for the filtering must be the same in main and sub search:

app=app1 
| rex field=environment_url "https:\/\/(?<app_name>.*)\.foo\.com" 
| search [ search app=app2 | fields app_name ]

if not, you have to rename it.

One additional hint: use always the index= filter to have faster searches.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @jacu86 ,

there's only one attention point: the field used for the filtering must be the same in main and sub search:

app=app1 
| rex field=environment_url "https:\/\/(?<app_name>.*)\.foo\.com" 
| search [ search app=app2 | fields app_name ]

if not, you have to rename it.

One additional hint: use always the index= filter to have faster searches.

Ciao.

Giuseppe

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...