Search based on response from another search query

[stagare]

First Splunk query gives me a value in a table. The value is a jobId. I want to use this jobId in another search query like a second one. Can we join them in Splunk way?

index=myindex cs2k_transaction_id_in_error="CHG063339403031900 major_code="ERROR" |  rex field=_raw "Job Id: (?<jobId>.*?)\." | table jobId

index=myindex "TTY"  "jobId"

[stagare]

Thanks for the reply, yes, I have tried that already. It does not work. The response (jobId) is in a table so that wont allow this subsearch.

[P_vandereerden · Accepted solution]

Ah.
I suspect this is more about the rex expression than the table.

You could try a join:

index=myindex TTY | rex field=_raw "Job Id: (?<jobId>.*?)\."
| join left=L right=R where L.jobId=R.jobId [search
index=myindex cs2k_transaction_id_in_error="CHG063339403031900" major_code="ERROR" | rex field=_raw "Job Id: (?<jobId>.*?)\." | table jobId ]

[stagare]

Hi Paul, this join looks to  be working. Thank you very much..

[P_vandereerden]

Have you tried a subsearch?

index=myindex "TTY" [ search index=myindex 
  cs2k_transaction_id_in_error="CHG063339403031900 major_code="ERROR" 
  |  rex field=_raw "Job Id: (?<jobId>.*?)\." 
  | table jobId ]