Get result from past query result as a parameter

[prategup1]

I have two queries which are working fine independently but I want to join those two and get the result in one go. Can you please help how to achieve that.

Logs having session Id :
2016-03-15 09:31:40,083 INFO dsadsadjsakldjsalkdjaskldj **Test@123456789*
(SessionId : 123456789 )*

Query1 : index=test "Search String1" | rex "Test@(?<SessionId>[^<]+)" | table SessionId :- From This we are extracting all the session id's.

Now we have to extract another value (IDNO) by checking logs for whole session using session id which is common in both queries.

Log having both SessionId and IDNO :
2016-03-15 09:31:40,027 INFO sadasdjadjhasjkdhsakdjshakdjhsakdja Test@123456789
IDNO 747711680

Query2 : index=test "Search String2" SessionId | rex "IDNO (?[^<]+)" | table ID

We have to print all ID values for corresponding sessionid values in last 24 hours.

Thanks in advance

[somesoni2]

Since, the session id is not originally extracted (and based on your sample 2nd search), you want to put the SessionId string value on to the search. Try something like this

index=test "Search String2" [search index=test "Search String1" | rex "Test@(?<SessionId>[^<]+)" | stats count by SessionId | table SessionId | rename SessionId as search ] | rex "IDNO (?<ID>[^<]+)" | stats count by ID

[DMohn]

Subsearches are your key to success here:

 index=test "Search String2" [search index=test "Search String1" | rex "Test@(?<SessionId>[^<]+)" | table SessionId]  | rex "IDNO (?[^<]+)" | table ID