How to get the Source from one query and search specific variable in that source??

[harshal_chakran]

Hi,

I have a sourcetype = ALLXMLDATA, where I have added multiple XML files as data inputs such XMLfile1, XMLfile2 and XMLfile3.

I need to search a specific variable (for e.g. xmlvar2) which might be present in any one of the source file. I am planning to get the source name from this specific variable in one search query and then pass this source name to another search query, to find another variable from it.

Is it possible?? . Please help

[somesoni2]

Try this

index=blah sourcetype=blan-blah [search sourcetype=ALLXMLDATA xmlvar2=* | stats count by source | fields - count] 

The subsearch will give you list of source (xml files) which has xmlvar2 variable (xmlvar2=* is equivalent to isnotnull(xmlvar2)). Then you use this subsearch to get the "source=abc" in your other search.

[piebob]

is this the same as the other question you just asked, Harshal? http://answers.splunk.com/answers/116197/how-do-i-get-the-value-of-one-field-if-the-value-of-another... if so, please delete this one.

[Ayn]

You should post more specifics about your data and what you want to do with it. Right now I'm confused about what you mean by variables in your data, source etc. Please elaborate.