For instance, I have a search where I want to query for a value that would set that value to orderid such as:
sourcetype="Source1" | search ErrorMessage | rex ".[1][1]=(?P
and this query is able to take the error message and find what follows "11=" and set its to a value called orderid, but I then want to take that value I've set as orderid and have it query from a second source all as part of the same query. I have tried adding this at the end in order to search the second source:
map search="search sourcetype="Source2" $orderid$"
So my entire query looks like this, I thought this would work but doesnt seem to be properly passing the value of orderid to query from the second source:
sourcetype="Source1" | search ErrorMessage | rex ".[1][1]=(?P
Please help answer or offer any insight you may have, I may be doing this entirely wrong!
Use a subsearch - it's used precisely for these kinds of scenarios.
http://docs.splunk.com/Documentation/Splunk/6.0/SearchTutorial/Useasubsearch
Ok, I am looking into this now, can you help me to better understand? Right now I have this:sourcetype="Source1" | search ErrorMessage | rex ".[1][1]=(?P
Which sets the orderid to a numerical value, what would I need to add to tell it to search "Source2" for that orderid?