Multisearch

[HealyManTech]

Is there a way to have if you extract data from a search to have it fun in another search? Like putting the field value into another search without having to manually type or script it out?

Example:

index=wineventlogs action=delete
| rex field=_raw "GID : (?.*)"
| table _time, ID
| (NEW Search) "ID" (how would I get that to populate)

Would I have to do a multisearch??

Thanks for the help.

[logloganathan]

Could you please try like this

index=wineventlogs action=delete
| rex field=_raw "GID : (?.*)"
| table _time, ID | join ID | [ Search "your query" | table ID, "any values you want" ] | table table _time, ID,"any values you want"

or

index=wineventlogs action=delete
| rex field=_raw "GID : (?.*)"
| table _time, ID | append | [ Search "your query" | table ID, "any values you want" ] | table table _time, ID,"any values you want"

Please refer the below document.it will help you
for append
http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Append

[HealyManTech]

I tried this but didn't work. I am trying to get the rex ID created field to be part of the new search but errors out.

[logloganathan]

do you want regex expression? i have provided example which tells how to do multisearch