I want to write a query like this
index=* "searchString1" | where in ([search "searchString2" | field key])
It may be incorrect syntax but let me explain that:
"index=* "searchString1" returns
"it is good abc" "it is good def" "it is good you"
"index=* "searchString2" returns
"I am bad key=abc" "i am fine key=def" "I am better key= fat"
Now my goal is to input the value of key from the second search result in the "in" clause of "where" of the first search so the output of looks like this.
"it is good abc" "it is good def"
Is it possible is splunk?
It is kind of a nested sql query.
I am quite new to splunk so need some help.