Splunk Search

How to use a rex field in another search

irvindominguezs
Explorer

I am trying the following query. However, activityId is not being passed to the second query and I am not having any results.

index=kubernetes lineOfBusiness=ifm component=chub useCase=C5 responsePayload
| rex field=_raw "imsiActivationDate\"\:\"(?<imsiActivationDate>[^\"]*)"
| rex field=_raw "simChangeDate\"\:\"(?<simChangeDate>[^\"]*)"
| rex field=_raw "activity-id=(?<activityId>[^||]*)"
| table activityId | map search="index=kubernetes lineOfBusiness=ifm component=ifm activity-id=*$activityId$*" | rex field=_raw "msisdn":"=(?<msisdn>[^=]*)" | dedup activityId, msisdn
| table activityId msisdn

Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @irvindominguezs,

Can you try below?

index=kubernetes lineOfBusiness=ifm component=chub useCase=C5 responsePayload
| rex field=_raw "imsiActivationDate\"\:\"(?<imsiActivationDate>[^\"]*)"
| rex field=_raw "simChangeDate\"\:\"(?<simChangeDate>[^\"]*)"
| rex field=_raw "activity-id=(?<activityId>[^||]*)"
| table activityId | map search="search index=kubernetes lineOfBusiness=ifm component=ifm activity-id=*$activityId$*" | rex field=_raw "msisdn":"=(?<msisdn>[^=]*)" | dedup activityId, msisdn
| table activityId msisdn
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

manjunathmeti
Champion

hi @irvindominguezs,

Instead of using the map command, you can use the first/main search as a sub search to filter activityId in the second search.

index=kubernetes lineOfBusiness=ifm component=ifm activity-id IN([| search index=kubernetes lineOfBusiness=ifm component=chub useCase=C5 responsePayload | rex field=_raw "activity-id=(?<activityId>[^||]*)" | eval activityId="*".activityId."*" | stats values(activityId) as re | return $re]) | rex field=_raw "msisdn":"=(?<msisdn>[^=]*)" | dedup activityId, msisdn
| table activityId msisdn

 

If this reply helps you, a like would be appreciated.

0 Karma

irvindominguezs
Explorer

Hello,

It did not work. I am still getting 0 results.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...