How to compare two searches using a shared variable?

[ckutach]

I am trying to make 2 searches using the same index and source.

The first search is looking for all entries with "message received" and the "Message Id". The second search is looking for the "Message Id" and "Message Type".  I am trying to find the number of messages received for a specific message type.

Example:

(index = exampleindex source = examplesource ("message received" AND "MessageId")  
| rex field=_raw "MessageId:(?<messageId1>[\S]+)\s.*" 
| eval Id1 = messageId1) 
OR (index = exampleindex source = examplesource ("MessageType" AND "MessageId")  
| rex field=_raw "MessageId:(?<messageId2>[\S]+)\s.*"  
| eval Id2 = messageId2)

 I want to compare the 2 searches and count how many Ids in the 1st search appear in the 2nd search

[richgalloway · Accepted solution]

The OR operator works within certain commands, but cannot be used to combine commands.

Use OR within the base search to fetch events with the desired data then group them by the shared field.

(index = exampleindex source = examplesource (("message received" AND "MessageId") OR ("MessageType" AND "MessageId"))
| rex field=_raw "MessageId:(?<messageId>[\S]+)" 
``` Combine events based on shared messageId values ```
| stats values(*) as * by messageId
``` Discard events without a MessageType ```
| where isnotnull(MessageType)
| stats count by MessageType