How do I use a field gathered from one search in a completely independent search (without a join)

[splunkuser2127]

I need to do one search with value A in the logs to get value B, then search on value B in another, independent search to get other information. How do I do this in Splunk (ideally without a join)?

[DalJeanis]

Let's assume that you need the value from

 index=foo sourcetype=bar Field1 ="A"
| fields Field1 Field2

Where the result happens to be

 Field1 Field2
   A      B

in order to make this search happen

index=foo sourcetype=baz Field3="B"
| fields field3 Field4

and get the results

Field3  Field4
  B       C

There are at least two ways to link those searches.

The first is with a subsearch to find the first results, then feed that to the second search. This is what @richgalloway showed you above.

index=foo sourcetype=baz
   [ search index=foo sourcetype=bar Field1 ="A" | table Field2 | rename Field2 as Field3 ]
| fields field3 Field4

The subsearch in square braces will return its result into the first search as ( Field3="B" ). To see exactly what the first search returns, run that search standalone (without the word search) and add on the end | format. the result text will be in a single variable called search.

That's fairly efficient if you are only running a single result, or if there are very few records at any given time to contend with.

However, if you wanted to match up large number of records, then you probably want to go with the "splunk soup" method.

 index=foo ( sourcetype=bar Field1 ="*") OR (sourcetype=baz Field3="*")
| fields sourcetype Field1 Field2 Field3 Field4
| eval matchField= if(sourcetype="bar",Field2,Field3)
| stats values(Field1) as Field1 values(Field4) as Field4 by matchField

This will give you all the various matched up records, including one which looks like

matchField Field1 Field4
  B          A      C

[richgalloway]

Depending on the details you didn't provide, you may be able to use a subsearch. Subsearches execute first and the results become part of the main search. The catch is a subsearch is limited to returning 10,000 events. It looks something like this

index=indexB [ search index=indexA | fields fieldB | format ]