Subsearch returning 2 fields and evaluation needed on one

[ramanjain1983]

Hi Guys,

I am trying to do this scenario where a subsearch is called to retrieve 2 fields using regex out of which only one exists in the primary search. But I want to use the second field to later display it along with my other fields.

Ex:-

PrimarySearch [ search secondary | rex "(?P<FieldA>.*)" | rex "(?P<FieldB>.*)"| fields FieldA FieldB ] |  rex "(?P<FieldC>.*)" | table FieldA FieldB FieldC

Now the challenge is that primary search do not have any field with name FieldB and even the even does not have any occurance of values which is in FieldB so the outcome of the query is nil.

The moment when I remove FieldB from subsearch it works fine. I understand that subsearch should return one argument against which you should pull out data in primary search but can anyone please help in my case where the judgement should be made based on fieldA only but fieldB should be displayed in final table outcome.

Thanks in advance.

[ramanjain1983 · Accepted solution]

Solved it using inner join. Thanks all.

[kristian_kolb]

Yes, probably something like;

primary [secondary | rex FieldA | fields fieldA] | join FieldA [secondary | rex FieldB] | more stuff

There might be more elegant solutions. You can do a lot with stats 🙂

[lguinn2]

It would be very helpful to see the actual searches instead of "PrimarySearch" and "secondary". Also, I agree with Kristian - it sounds like join or something else might be a better option.

[kristian_kolb]

Without knowing what data you have, it's a bit hard to give good guidance. Have you invesigated any alternative route?

transaction, append, multisearch, or even join?