Splunk Search

Multisearch

HealyManTech
Explorer

Is there a way to have if you extract data from a search to have it fun in another search? Like putting the field value into another search without having to manually type or script it out?

Example:

index=wineventlogs action=delete
| rex field=_raw "GID : (?.*)"
| table _time, ID
| (NEW Search) "ID" (how would I get that to populate)

Would I have to do a multisearch??

Thanks for the help.

0 Karma

logloganathan
Motivator

Could you please try like this

index=wineventlogs action=delete
| rex field=_raw "GID : (?.*)"
| table _time, ID | join ID | [ Search "your query" | table ID, "any values you want" ] | table table _time, ID,"any values you want"

or

index=wineventlogs action=delete
| rex field=_raw "GID : (?.*)"
| table _time, ID | append | [ Search "your query" | table ID, "any values you want" ] | table table _time, ID,"any values you want"

Please refer the below document.it will help you
for append
http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Append

0 Karma

HealyManTech
Explorer

I tried this but didn't work. I am trying to get the rex ID created field to be part of the new search but errors out.

0 Karma

logloganathan
Motivator

do you want regex expression? i have provided example which tells how to do multisearch

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...