How to pass the results of the first query into a second query based on a common field

[bcronrath]

I have an initial query that returns all instances of 500 internal errors in a log file. However, these entries have an ID that maps to a different log entry that does not have a result code setting, but contains the actual error that I need to view. If it helps, this is a quick visualization of how I am looking at the individual errors:

Step 1 - "Search for 500 errors across hosts"
Step 2 - "Grab a specific ID field from one of these entries that are returned
Step 3 - "Search across hosts for that specific ID"
Step 4 - "The single entry that I grabbed the ID for now shows the separate entry that has the actual error details"

My problem is that I can't afford to go through all of these 1 by 1, what I would like is to see all of the entries that have the actual error details (in other words I want to see a list of all the entries that Step 4 gives me above).

I had thought doing something like this:

result_code=500 | join c_id []

Would accomplish this, but that just returns an empty set.

[aweitzman · Accepted solution]

It looks like a subsearch would be appropriate here:

sourcetype=hosts [search sourcetype=hosts result_code=500 | table c_id]

The subsearch goes through hosts and finds the c_id values for all of the entries with a result_code of 500. That list of c_id values is then applied to the main search as a big OR clause ( c_id=123 OR c_id=456 OR ... ), which ought to get you the results you want.

[mvaradarajam]

Not working.....

[aweitzman]

Could you please be more specific? What is the search you are running, and which part of it is not doing what you expect?