Splunk Search

How to input the value of key from the second search result in the "in" clause of "where" of the first search?

New Member

HI
I want to write a query like this

index=* "searchString1" | where in ([search "searchString2" | field key]) 

It may be incorrect syntax but let me explain that:

suppose the "index=* "searchString1" returns

"it is good abc"
"it is good def"
"it is good you"

and the "index=* "searchString2" returns

"I am bad key=abc"
"i am fine key=def"
"I am better key= fat"

Now my goal is to input the value of key from the second search result in the "in" clause of "where" of the first search so the output of looks like this.

"it is good abc"
"it is good def"

Is it possible is splunk?
It is kind of a nested sql query.
I am quite new to splunk so need some help.

Saurabh

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Give this a try

index=* "searchString1" | where [search index=* "searchString2" | stats count by key | table key]

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Give this a try

index=* "searchString1" | where [search index=* "searchString2" | stats count by key | table key]

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Wouldn't it actually be easier like this?

index=* "searchString1" [index=* "searchString2" | stats count by key | fields key] 
0 Karma