How to search for a field using value of other field

[deepakmr8]

Hi,

I have two fields, both these fields will be in two different events, now  i want to search for events, where aggr_id=*session_ID*, basically i'm looking to search for field1=*field2*

field1: session_ID= 1234567890

field2: aggr_id= ldt:1234567890:09821

[ITWhisperer]

It is not usually good to start a search with a wildcard, so assuming aggr_id always starts with Idt:, you could do something like this 

| makeresults
| eval aggr_id="ldt:1234567890:09821"
| search 
    [| makeresults
    | eval session_ID= 1234567890
    | eval aggr_id="ldt:".session_ID."*"
    | table aggr_id
    | dedup aggr_id]

The makeresults just set up dummy data and should be replaced by your index search

<index search> [search index
    | eval aggr_id="ldt:".session_ID."*"
    | table aggr_id
    | dedup aggr_id]

[gcusello]

Hi @deepakmr8 ,

if the rule in the second field is fixed, you could use a regex to extract the relevant part fo the match:

<your_search>
| rex field=aggr_id "^\w+:(?<extract>[^:]+)"
| search session_ID=extract

Ciao.

Giuseppe