Using field of a search in other search

[bsaujla131984]

I am trying to use a field of a Index1 in Index2 to search for status of Correlation ID, but it is not working as expected.

For example... Batch job A has Correlation id, I want to check the status of that Correlation ID in Batch Job B ..

index=Index1 host=xxx source="yyy" CorrID AND Batch Job B | dedup CorrID | table CorrID
| append[search index=Index2 host=xxx source="yyy" Corr id AND BatchJob A AND "Message Enqueued to database access layer : " | rex "Corr ID[\\": ](?[^\\":]) Queue:"] | fields CorrID | dedup CorrID |table CorrID | stats count by CorrID
| where count=1

[woodcock]

Like this:

index=Index2 host=xxx source="yyy" Corr id AND BatchJob A AND "Message Enqueued to database access layer : "
| rex "Corr ID[\\\": ]*(?<CorrID>[^\\\":]*) Queue:"]
| search [search index=Index1 host=xxx source="yyy" CorrID AND Batch Job B  | dedup CorrID | table CorrID]
| stats count BY CorrID
| where count == 1

[gcusello]

Hi bsaujla131984,
you are thinking as you're using a DB, Splunk thinks different!
Let me understand:

• CorrId A and CorrId B are the same or different, and where they come from?
• idem BatchJob?
• List item

in Splunk you can use the results of a sub search as filter for the main search, something like this:

index=Index1 host=xxx source="yyy" CorrID=B BatchJob=B (search index=Index2 host=xxx source="yyy" Corr_id=A BatchJob=A "Message Enqueued to database access layer : " | dedup CorrId | fields CorrId]
| ...

but you must be sure that you're using the same field name in both the searches.

If instead you want to correlate the results of two searches, you can use the transaction command but it's very slow, so you can use the stats command, something like this:

(index=Index1 host=xxx source="yyy" CorrID=B BatchJob=B) OR (index=Index2 host=xxx source="yyy" Corr_id=A BatchJob=A "Message Enqueued to database access layer : " 
| rex "your_regex"] 
| stats count by CorrID

Please, could you share more details about the searches and the fields?

Bye.
Giuseppe