Hi Splunkers,
I need the result from first search in another search.
First search:
sourcetype=win_server | multikv fields ID Servername | search Servername=$INPUT$ | table ID | dedup ID
--> gives me for exmaple ID 13 back
At next I need this ID for figure out the location
Secound search:
sourcetype=win_server | multikv fields ID Location | search ID=$INPUT$ | table Location | dedup Location
Can anyone help me to bring them together?
Thanks a lot
Cheers
I think you will need to use the subsearch (docs) field, "search" (shown in the subsearch docs), you should then be able to modify your search to the following:
sourcetype=win_server | multikv fields ID Location | search [search sourcetype=win_server | multikv fields ID Servername | search Servername=$INPUT$ | table ID | dedup ID | rename ID as search | fields + search] | table Location | dedup Location
Basically this should be equivalent to you typing ".. | search ID=13 |.." if you were to search the data manually. (additionally... the "query" performs a more generic search, i.e. "... | search 13 | ...").
Regards,
MHibbin
I think you will need to use the subsearch (docs) field, "search" (shown in the subsearch docs), you should then be able to modify your search to the following:
sourcetype=win_server | multikv fields ID Location | search [search sourcetype=win_server | multikv fields ID Servername | search Servername=$INPUT$ | table ID | dedup ID | rename ID as search | fields + search] | table Location | dedup Location
Basically this should be equivalent to you typing ".. | search ID=13 |.." if you were to search the data manually. (additionally... the "query" performs a more generic search, i.e. "... | search 13 | ...").
Regards,
MHibbin
nice one, have fun!
thanks a lot. Worked great!