Use extracted field in a subsearch

[kochera]

Hi,

I would like to combine two searches. The first one gives me the session-id which i would like to use in a second search, e.g.

Query 1: index=main 123.123.123.156 source="/appl/log/www/access.log" |rex field=raw "\"\s\"(?[A-z,0-9,-.]+)"

Query 2: index=main $SessionID$ source="/appl/log/www/access.log"

Cheers, Andy

[MuS · Accepted solution]

Hi kochera

you could use something like that (I used a different regex for this example!):

index="main" 123.123.123.156 source="/appl/log/www/access.log" [search index="main" source="/appl/log/www/access.log" | rex field=_raw "(?i)^(?:[^-]*-){5}\s+(?P.+)" | fields requestid ]

the sub search will result in a list of:

( ( requestid="xxxxxxxxxxxxxxxxx" ) OR ( requestid="xxxxxxxxxxxx" ) OR ( requestid="xxxxxxxxx" ) )

and this will be used in the search.

hope this helps

MuS

[kochera]

if I leave the IP away, then I see results but as you mentioned, this doesn't make any sense...

[MuS]

okay leave the IP completely away in any search; but then I wonder why are you using a sub search anyway?

[kochera]

yes, that's what I'm trying at the moment

index=main source="/appl/log/www/access.log" [search index=main source="/appl/log/www/access.log" "123.123.123.156" |rex field=raw "\"\s\"(?[A-z,0-9,-.]+)"| fields + sessionid]

But somehow I don't get any results...

[MuS]

well then just leave the IP away in the main search, then you should see any SessionID of any IP.

[kochera]

Hi, thanks for your answer. I'm not sure if this gives me the correct result. I would like to check if the same SessionID is used with a different IP-Adress.