How to use a rex field in another search

[irvindominguezs]

I am trying the following query. However, activityId is not being passed to the second query and I am not having any results.

index=kubernetes lineOfBusiness=ifm component=chub useCase=C5 responsePayload
| rex field=_raw "imsiActivationDate\"\:\"(?<imsiActivationDate>[^\"]*)"
| rex field=_raw "simChangeDate\"\:\"(?<simChangeDate>[^\"]*)"
| rex field=_raw "activity-id=(?<activityId>[^||]*)"
| table activityId | map search="index=kubernetes lineOfBusiness=ifm component=ifm activity-id=*$activityId$*" | rex field=_raw "msisdn":"=(?<msisdn>[^=]*)" | dedup activityId, msisdn
| table activityId msisdn

[scelikok]

Hi @irvindominguezs,

Can you try below?

index=kubernetes lineOfBusiness=ifm component=chub useCase=C5 responsePayload
| rex field=_raw "imsiActivationDate\"\:\"(?<imsiActivationDate>[^\"]*)"
| rex field=_raw "simChangeDate\"\:\"(?<simChangeDate>[^\"]*)"
| rex field=_raw "activity-id=(?<activityId>[^||]*)"
| table activityId | map search="search index=kubernetes lineOfBusiness=ifm component=ifm activity-id=*$activityId$*" | rex field=_raw "msisdn":"=(?<msisdn>[^=]*)" | dedup activityId, msisdn
| table activityId msisdn

[manjunathmeti]

hi @irvindominguezs,

Instead of using the map command, you can use the first/main search as a sub search to filter activityId in the second search.

index=kubernetes lineOfBusiness=ifm component=ifm activity-id IN([| search index=kubernetes lineOfBusiness=ifm component=chub useCase=C5 responsePayload | rex field=_raw "activity-id=(?<activityId>[^||]*)" | eval activityId="*".activityId."*" | stats values(activityId) as re | return $re]) | rex field=_raw "msisdn":"=(?<msisdn>[^=]*)" | dedup activityId, msisdn
| table activityId msisdn

If this reply helps you, a like would be appreciated.

[irvindominguezs]

Hello,

It did not work. I am still getting 0 results.