Splunk Search

How can I pass a value I retrieve in the first part of a query to a second part in a second source?

dlespron
Path Finder

For instance, I have a search where I want to query for a value that would set that value to orderid such as:

sourcetype="Source1" | search ErrorMessage | rex ".[1][1]=(?P\d+)\D" | search "|11=|" | fields orderid

and this query is able to take the error message and find what follows "11=" and set its to a value called orderid, but I then want to take that value I've set as orderid and have it query from a second source all as part of the same query. I have tried adding this at the end in order to search the second source:

map search="search sourcetype="Source2" $orderid$"

So my entire query looks like this, I thought this would work but doesnt seem to be properly passing the value of orderid to query from the second source:

sourcetype="Source1" | search ErrorMessage | rex ".[1][1]=(?P\d+)\D" | search "|11=|" | fields orderid | map search="search sourcetype="Source2" $orderid$"

Please help answer or offer any insight you may have, I may be doing this entirely wrong!

Tags (4)
0 Karma

Ayn
Legend

Use a subsearch - it's used precisely for these kinds of scenarios.

http://docs.splunk.com/Documentation/Splunk/6.0/SearchTutorial/Useasubsearch

dlespron
Path Finder

Ok, I am looking into this now, can you help me to better understand? Right now I have this:sourcetype="Source1" | search ErrorMessage | rex ".[1][1]=(?Pd+)D" | search "|11=|" | fields orderid

Which sets the orderid to a numerical value, what would I need to add to tell it to search "Source2" for that orderid?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...