Splunk Search

Pass the output of one query to another query

Deepz2612
Explorer

Hi,
My 1st query returns 3 fields output.Out of which one filed has to be given as input to the second query which fetches 3 fields along with this result value.
Kidnly help

Tags (1)
0 Karma

DMohn
Motivator
<your second query> [ search <your first query> | return <your field>] | table <your other fields>

The first query needs to go as a subsearch (the part in []) and return the needed field back to the main search (which in your case is the second query). You can select which field to use as a result in the main search with the return command. Normally it would look something like "field=value1 OR field=value2 OR ...."
If you need another return format, please refer to the command documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Return

0 Karma

Deepz2612
Explorer

Hi,

The above doesnt seem to work.It returns me 0 results.

0 Karma

MoniM
Communicator
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Try this as a starting point: YOUR_SEARCH | append [SECOND SEARCH]

You need to supply more details if you want better help.

0 Karma

Deepz2612
Explorer

I have events like below with Job name and Incident number

Index= abc
Job: scdefgh_tal1080_d_b
App: YSC
Incident_Create_Number: INC0000XXXXXXXX

So I wrote a query to extract them as below:
index=abc |rex field=notes "Job:(?.*)\nApp" |table Job Incident_Create_Number Incident_Create_Assigned_Group

I have events where like below having Job name and its status
Index= xyz
CAUAJM_I_40245 EVENT: CHANGE_STATUS STATUS: TERMINATED JOB: iascamdsp_tal1080_d_b

So I wrote a query to extract them as below:
index=xyz | rex "]\s+(?\S+)\s+(?:((EVENT:)?\s(?\S+)\s+(STATUS:)?\s+(?\S+)\s+(JOB:)?\s+(?\S+)(\s+(MACHINE:)?\s+(?\S+))?(\s+(EXITCODE:)?\s+(?\S+))?))" |search event_1="CHANGE_STATUS" |table Job Job_Status

Now I wanted to combine both.For the Job name in the first query I want its status from the second query.
I tried using Join but its not returning any results.
Kindly help!

0 Karma

DMohn
Motivator

I assume you will have to use a join here:

index=abc |rex field=notes "Job:(?.*)\\nApp" | join Job [ index=xyz | rex "]\s+(?\S+)\s+(?:((EVENT:)?\s(?\S+)\s+(STATUS:)?\s+(?\S+)\s+(JOB:)?\s+(?\S+)(\s+(MACHINE:)?\s+(?\S+))?(\s+(EXITCODE:)?\s+(?\S+))?))" |search event_1="CHANGE_STATUS" |fields Job Job_Status] | table Job  Job_Status Incident_Create_Number Incident_Create_Assigned_Group
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...