How to search a field for values that are stored in another field?

[macoo]

Hi,

Can you please help me with the following case? I'm trying to use the value of a field to search within the values of another field. The search is as follows and it does not work:

index = dummy | eval FieldA=case(...) | search FieldB=FieldA

Output: it should return the rows whose FieldB equals FieldA.

It doesn't seem difficult, but Splunk cannot handle that.

Thanks

[sundareshr]

Try the where command. Like this .. | where fieldA=fieldB

[somesoni2]

Your question title says subsearch and I don't see a subsearch in your example query. Could you provide the actual query that you're trying run (mask anything sensitive, just want to look at the eval of FieldA and usage of it in "subsearch")

[macoo]

By the subsearch, I mean "| search FieldB = FieldA". A general problem is that I find it impossible to search a partiular field, e.g. FieldA for values that are stored in Field B. Do you see my point?

[macoo]

Another example:

index=veryBigIndex | eval valueContainer="dummyUser" | search UserList=valueContainer

[macoo]

So, find users that are called "dummyUser"

[Akumar294]

Hello Macoo,

Were you able to arrive at a solution, i have a similar problem:

Please first read case 2- it gives me the desired result but case 1 fails.
my job number changes everyday but it remains unique for the same day, i am trying to automate the search so that same search is valid for second day and all other days.
Basically i am looking for the completion status of Job number based on certain parameters that are defined in my search, please let me know for further inputs.

Flow goes like : searching whole data-->extracting job number-->searching for my required data-->storing the desired job_number into my own variable using eval-->appending a new search which will append the whole event again, then further used pipe to search for my specific data.

Case 1 - index="ncenter" sourcetype="agent" | rex field=_raw "\.(?\d\d\d\d\d\d\d)\."|search BSC=DMS_01_UNZIP_RENAME AND ktg|dedup Job_Number|eval ktg_job=Job_Number|
append[search index="ncenter" sourcetype="agent"]|search ktg_job=* AND completed

Case 2- index="ncenter" sourcetype="agent" | rex field=_raw "\.(?\d\d\d\d\d\d\d)\."|search BSC=DMS_01_UNZIP_RENAME AND ktg|dedup Job_Number|
append[search index="ncenter" sourcetype="agent"]|search manually_putting_my_job_number AND completed