Splunk Search

How to write a query which take all this values and search for results in different sourcetype=source2?

Mofizul
Loves-to-Learn Lots

 

index=instance1 sourcetype=source1 "Invalid-Access" | fields reqId | table reqId

 

The above query gives me a table as below

12A

32B

34C

Unable to write a query which take all this values and search for results in different sourcetype=source2.

Tried this below but not getting the results. Can anyone help ?

 

index=instance1 sourcetype=source2 [search index=instance1 sourcetype=source1 "Invalid-Access" | fields reqId | table reqId]

 

 

Labels (1)
0 Karma

PickleRick
Ultra Champion

Depends on what exactly you want to achieve.

Your search will effectively be expanded in run-time using subsearch results to

index=instance1 sourcetype=source2 ( reqId=12A OR reqId=32B OR reqId=34C)

 Is that what you wanted?

0 Karma

Mofizul
Loves-to-Learn Lots

Yes .

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the format command instead of table to put the results of the subsearch into a format that can be queried.  Note that source1 and source2 must both have a field called 'reqId' or the subsearch will have to rename reqId to whatever source1 uses.

index=instance1 sourcetype=source2 [search index=instance1 sourcetype=source1 "Invalid-Access" | fields reqId | format ]

 

 

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Mofizul
Loves-to-Learn Lots

Source1 has reqId but source 2 has the same value as reqId but it is a string.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...