[Jan 19 09:35:00.00] VERBOSE: foo, foo, "x-cid: AAAAA")
[Jan 19 09:35:10.00] VERBOSE: foo, foo, "x-cid: AAAAA")
[Jan 19 09:35:20.00] VERBOSE: bar, bar, "some text")
[Jan 19 09:35:30.00] VERBOSE: bar, bar, "some different text")
I have REGEX'd the following fields:
- x-cid: AAAAA
- PID: 11111
- PID: 22222
Using the above log set example, I want to search for AAAAA and return all 4 log events.
Effectively, the query will first search for AAAAA, capture the PIDs, then do a sub search for the PIDs (both) and return the full results.
I have been playing with append, appendpipe, join... but can't figure out the subsearch.
Assuming the field extraction for x-cid (with field name as x_cid) and PID is saved in conf files, try like this
index=foo sourcetype=bar [search index=foo sourcetype=bar x_cid="AAAAA" | stats count by PID | table PID ] | rest of the search
Basically the subsearch get the PIDs which correspond to x_cid="AAAAA", and includes a dynamic giant OR condition to filter events. In your example above, the subsearch should return 11111 and 22222 and your normalized search would be like this
index=foo sourcetype=bar ((PID=11111) OR (PID=22222))
And it should fetch all the records that you want.