Is there a way to have if you extract data from a search to have it fun in another search? Like putting the field value into another search without having to manually type or script it out?
Example:
index=wineventlogs action=delete
| rex field=_raw "GID : (?.*)"
| table _time, ID
| (NEW Search) "ID" (how would I get that to populate)
Would I have to do a multisearch??
Thanks for the help.
Could you please try like this
index=wineventlogs action=delete
| rex field=_raw "GID : (?.*)"
| table _time, ID | join ID | [ Search "your query" | table ID, "any values you want" ] | table table _time, ID,"any values you want"
or
index=wineventlogs action=delete
| rex field=_raw "GID : (?.*)"
| table _time, ID | append | [ Search "your query" | table ID, "any values you want" ] | table table _time, ID,"any values you want"
Please refer the below document.it will help you
for append
http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Append
I tried this but didn't work. I am trying to get the rex ID created field to be part of the new search but errors out.
do you want regex expression? i have provided example which tells how to do multisearch