Splunk Search

Searching the results of a query in a different index

9jamie
Explorer

I have a query that returns a table of extracted IDs:

index=my_index | rex field=_raw "ID=\[(?<id>.*\]\[.*\]" | table id

I simply need to search the results of the above query under a different index, then return a stats count by a field from that index. I've tried using subsearch and join but must not be using them correctly as no results are returned. What would be the correct way to do this?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=other_index [ index=my_index | rex field=_raw "ID=\[(?<id>.*\]\[.*\]" | table id ]
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@9jamie - I may be wrong here but have you tried running something like this?

index=* | rex field=_raw "ID=\[(?<id>.*\]\[.*\]" 
| stats count by id, index

 

I hope this helps!!! Karma/Upvote would be appreciated!!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Please give details of the subsearch you have tried

0 Karma

shivanshu1593
Builder

Hello,

 

You can try the following and pick what best suits your requirements:

 

1. Via Join:

 

index=my_index 
| rex field=_raw "ID=\[(?<id>.*\]\[.*\]"
| table id 
| join id [ search index=foo | table id bar] 
| stats count by bar id

 

 

2. By multisearch:

 

| multisearch [search index=myindex | rex field=_raw "ID=\[(?<id>.*\]\[.*\]"| fields id baz]
[search index=foo | rename id as id2 | fields id2 bar]
| eval match = if(id=id2, 1, 0)
| where match = "1"
| stats count by bar Baz id

 

 

Hope this helps,

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...