How to use field values from a search results to make a new search non related to the previous one?

[edrivera3]

Hi
After a search I extracted the field "test_number". Now I would like to use those extracted field values to make a new search through different data which already contains the field "test_number". At the end, I am expecting to get the events from the new data that contains the same field values.

[sideview · Accepted solution]

I think you're looking for subsearches.

<search terms for search 2> [ search <search terms for search 1> | table test_number]

The bracketed search will be run, and what will come out to the outer search in place of the bracketed expression will be something like (test_number=123 OR test_number=345 OR test_number=456)

http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Usesubsearchtocorrelateevents

However more generally if you aren't familiar with subsearches, you should start from the top and go through the Search manual. Subsearches are frequently overused by new Splunk users in places where other approaches would be simpler and faster.

http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Aboutsearch

or go through the tutorial. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchTutorial/WelcometotheSearchTutorial