How can I pass a value I retrieve in the first part of a query to a second part in a second source?

[dlespron]

For instance, I have a search where I want to query for a value that would set that value to orderid such as:

sourcetype="Source1" | search ErrorMessage | rex ".[1][1]=(?P\d+)\D" | search "|11=|" | fields orderid

and this query is able to take the error message and find what follows "11=" and set its to a value called orderid, but I then want to take that value I've set as orderid and have it query from a second source all as part of the same query. I have tried adding this at the end in order to search the second source:

map search="search sourcetype="Source2" $orderid$"

So my entire query looks like this, I thought this would work but doesnt seem to be properly passing the value of orderid to query from the second source:

sourcetype="Source1" | search ErrorMessage | rex ".[1][1]=(?P\d+)\D" | search "|11=|" | fields orderid | map search="search sourcetype="Source2" $orderid$"

Please help answer or offer any insight you may have, I may be doing this entirely wrong!

[Ayn]

Use a subsearch - it's used precisely for these kinds of scenarios.

http://docs.splunk.com/Documentation/Splunk/6.0/SearchTutorial/Useasubsearch

[dlespron]

Ok, I am looking into this now, can you help me to better understand? Right now I have this:sourcetype="Source1" | search ErrorMessage | rex ".[1][1]=(?Pd+)D" | search "|11=|" | fields orderid

Which sets the orderid to a numerical value, what would I need to add to tell it to search "Source2" for that orderid?