Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How initiate second search after getting field val...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have two different searches. How do I concatenate them?
Search 1:
string1 | rex field=_raw "{(?\d+)"
Search 2:
string2 | rex field=_raw "needed * (?\d+)" | search runtime>5000
string1 != string2. What I want is to filter the results of search 2 by the item IDs found by search 1. How do I do it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Ben,
This is known as Sub-Searching, please see the link below which is the documentation for Sub searches.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Search/Aboutsubsearches
Hope it helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Ben,
This is known as Sub-Searching, please see the link below which is the documentation for Sub searches.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Search/Aboutsubsearches
Hope it helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Helped me partly. Thanks
what I needed is furthermore was way of how to filter by all found field values. For this it is essential to differ between "rename my_field" as search and "rename my_field as query".
So the resulting query in my case would be:
string2* [|search string1 | rex field=_raw "{(?<my_field>-*\d+)"| rename my_field as query | fields query]* | rex field=_raw "needed * (?<runtime>\d+)" | search runtime>5000
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Ben,
Glad it helped.
Please vote up!
Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...
Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions
Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...
