Searching a 2nd index with a field extraction using rex

[dhabbal]

I have a index=weblogs where I filter results and then REX extract an IP address to a new field called RemoteIP.

I want to then search our firewall logs on index=firewall for that newly extracted field RemoteIP.

I have been playing around with sub searches and joins but not getting far. 

[dhabbal]

Believe it or not I figured it out shortly after you posted this solution. Thank you!


Can I ask how to now use join? I want to bring in fields from index=weblogs into the outter search. 

The common field would be src_ip. 

[ITWhisperer]

index=firewall 
| join ipFieldInFirewall [ search index=weblogs | rex "extract remote ip" | dedup remoteIP | rename remoteIP as ipFieldInFirewall | fields ipFieldInFirewall plus other fields ]

[dhabbal]

Thanks for this, I tried this join syntax earlier but the search was very slow and wasn't able to be completed.

Firewall logs are huge but I thought the subsearch runs first that feeds the join cmd, in my mind it should run fairly quickly but it's taking very long. 

Any ideas how to make the search more performative?

[ITWhisperer · Accepted solution]

index=firewall [ search index=weblogs | rex "extract remote ip" | dedup remoteIP | rename remoteIP as ipFieldInFirewall | fields ipFieldInFirewall ]