I'm looking to find everything that has the string "Task Failed". I want splunk to get the task_id and then use all those task_id's for another search which looks for different strings but only ones that also have the ID's it found in the initial search.
I think a subsearch would do the trick for you;
Assuming that you have
sourcetype_A containing the
task_id's you look for, and
sourcetype_B is where you want to search for
different_string where the
sourcetype=sourcetype_B different_string=* [search sourcetype_A "Task failed" | fields + task_id]
the subsearch finds all events with "Task failed", and returns;
task_id=X OR task_id=Y OR task_id=Z
task_id's found, and they are passed as parameters to the outer search.
Hope this helps,
then just use the same sourcetype name in both places. however, i would recommend using instead of
fields, the new
return command, as
return 10000 task_id. This basically combines
dedup, and makes explicit the number of task_ids max that will be considered.