How to search by variable created within a join query?

[akonduru]

I want join/combine two searches by their common value to compare transaction success/failure rate at both places. i tried something below, but unable to search by evaluated result

Step1: Extract substring from second log as this value exactly doesn't match within first log.

index=indexoffirstlog sourcetype="secondlog" eval length=len(fieldinterestedin) | eval transaction_id=substr(fieldinterestedin, 6, length)

Step2: Search results within first log where result contain transaction_id (Not Joined yet, just checking first log query alone)

index=indexoffsfirstlog sourcetype="firstlog" matchstringoffirstlog

Step3: Now join both searches and search by transaction_id

index=indexoffirstlog AND index=indexofsecondlog sourcetype="secondlog" matchstringoffirstlog | eval length=len(fieldinterestedin) | eval result=substr(fieldinterestedin, 6, length) | search result

But i am not getting any results. appreciate any advice.

[woodcock]

Change your AND to OR!

[somesoni2]

Is the length of fieldinterestedin constant?

[akonduru]

No, It is not same. length varies. But fieldinterestedin always start wit constant like "ABCD23423fsdfsd" where ABCD is constant.

[somesoni2]

Final doubt, if you remove the constant part in the fieldinterestedin field from search 2, would it match exactly with fieldinterestedin in search 1?

[akonduru]

yes, it match except the constant part which is why i am doing substring to take off Constant part.