Splunk Search

Search based on response from another search query

stagare
Explorer

First Splunk query gives me a value in a table. The value is a jobId. I want to use this jobId in another search query like a second one. Can we join them in Splunk way?

index=myindex cs2k_transaction_id_in_error="CHG063339403031900 major_code="ERROR" |  rex field=_raw "Job Id: (?<jobId>.*?)\." | table jobId


index=myindex "TTY"  "jobId"

Labels (1)
0 Karma
1 Solution

P_vandereerden
Splunk Employee
Splunk Employee

Ah.
I suspect this is more about the rex expression than the table.

You could try a join:

index=myindex TTY | rex field=_raw "Job Id: (?<jobId>.*?)\."
| join left=L right=R where L.jobId=R.jobId [search
index=myindex cs2k_transaction_id_in_error="CHG063339403031900" major_code="ERROR" | rex field=_raw "Job Id: (?<jobId>.*?)\." | table jobId ]

 

Paul van der Eerden,
Breaking software for over 20 years.

View solution in original post

stagare
Explorer

Thanks for the reply, yes, I have tried that already. It does not work. The response (jobId) is in a table so that wont allow this subsearch.

0 Karma

P_vandereerden
Splunk Employee
Splunk Employee

Ah.
I suspect this is more about the rex expression than the table.

You could try a join:

index=myindex TTY | rex field=_raw "Job Id: (?<jobId>.*?)\."
| join left=L right=R where L.jobId=R.jobId [search
index=myindex cs2k_transaction_id_in_error="CHG063339403031900" major_code="ERROR" | rex field=_raw "Job Id: (?<jobId>.*?)\." | table jobId ]

 

Paul van der Eerden,
Breaking software for over 20 years.

stagare
Explorer

Hi Paul, this join looks to  be working. Thank you very much..

0 Karma

P_vandereerden
Splunk Employee
Splunk Employee

Have you tried a subsearch?

index=myindex "TTY" [ search index=myindex 
  cs2k_transaction_id_in_error="CHG063339403031900 major_code="ERROR" 
  |  rex field=_raw "Job Id: (?<jobId>.*?)\." 
  | table jobId ]
Paul van der Eerden,
Breaking software for over 20 years.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...