How to obtain data from one search and store it in a variable to search data in another search?

[paritoshs24]

My search is  like  this 

index = idx source = src data_stamp = A  field1 = *lol* | table Field2   
--> This generates a column  with only value which i need to store in some $VAR

index = idx  source = src data_stamp = B field1 = *lol* TEST = $VAR | table field 3

[richgalloway · Accepted solution]

Splunk doesn't have variables.  One can use tokens in a dashboard for an equivalent function, but that's not available in SPL.

One alternative is a subsearch.  A subsearch runs first and its results become part of the main search.

index = idx  source = src data_stamp = B field1 = *lol* [ index = idx source = src data_stamp = A  field1 = *lol* | return TEST=Field2 ] | table field 3

In this example, the subsearch is in square brackets and runs the specified search.  The return command creates a result with the Field2 field renamed to TEST.  The main search then becomes 

index = idx  source = src data_stamp = B field1 = *lol* TEST=foo | table field 3

[paritoshs24]

Hi .... Its working...thanks for the help.
One  more thing to ad in subsearch :
Can I use IN command ??

index = idx  source = src data_stamp = B field1 = *lol* [ index = idx source = src data_stamp IN (A B)  field1 = *lol* | return TEST=Field2 ] | table field 3

I need to pass multiple values of data_stamp.

[richgalloway]

Yes, the IN operator may be used in a subsearch.

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[PickleRick]

It's worth pointing out that subsearches have their own limitations and - especially with big searches - are best avoided. The same result can quite often be achieved another way.

[paritoshs24]

Can you please point out how subsearch could be escaped ?

[paritoshs24]

@ITWhisperer