Using subsearch result as a variable

[ethanmwk]

Hello,

This is my first post, so I apologize if I'm lacking in some sort of post etiquette or other guidelines. I'm trying to execute a query over a database of logs, where different types of logs have different fields. I'd like my query to accomplish two things:

1) search for logs of type A, and group results based on field 1 (integer field), field 2 (integer field), and field 3 (string field) (the aggregation operator will be a count)

I know how to accomplish step 1

logType=A (fieldA=5* OR fieldA=4*)  | stats count BY fieldA, fieldB, fieldC |  sort  -count +desc

the tricky part is completing step 2

2) for each result in query 1 (our subsearch), search for all logs of type B such that field 4 (a string field in log type B, that logs of type A do NOT contain) contains field 2 (cast to a string, as field 2 holds integers for logs of type A and we are seeing if the text value of this integer is in field 4) and contains field 3. 

By contains, I mean in the literal String.contains() meaning. Field 4 will be a very long message stored in a string, and will contain the values stored in fields 2 and 3 of log type A. I'm searching for logs of type B that correspond to the specific logs of type A that were returned in my subsearch.

logs of type B do not contains fields 1, 2, or 3, so I need to extract these fields from logs of type A, then see if field 4 in logs of type B contain these values. Is there any way to do this in one query? The first problem that I've come across is that subsearches are (I believe) meant to return one result, whereas mine must return multiple results. Furthermore, subsearches are meant to add an extra parameter, or narrow down your outer search, but the log type I'm searching over in my outer search doesn't contain the fields that my subsearch produces. Any help on this would be greatly appreciated!

[to4kawa]

try eval , case with match() and make your conditions. not subsearch.

[ethanmwk]

Will this work if the values stored in the fields I'm retrieving from log type A are dynamic? I can only find resources for using case() and match() with explicit, static values or wildcards rather than with search results (for instance, I would need to do something like:

if((match(logB.field4, logA.field2) AND match(logB.field4, logA.field3)), logB.field4, "null") but I'm not sure how to do this with every instance of log B and every instance of log A, rather than with some explicit value.

[to4kawa]

Have you seen the command reference?
match() can use REGEX not windows-like asterisk

sample:

index=_internal | head 1 | fields _time _raw | eval _raw="aaabbbbbcccddee"
| eval match_text="a{3}"
| eval flag=if(match(_raw,match_text),"match","not match")

[ethanmwk]

This is close to what I want to do, but I'm wondering if there is a way for one of the match() parameters to be a list of potential values, rather than one value. For example

match(_raw, anything_from_list, "match", "no match")

I don't know what values are going to be in this list or how long the list will be, because the list needs to be generated from an earlier query (the one labelled as query 1 in my original post) so I can't use CASE() to cover all of the options. Is there a way I can do this?

[to4kawa]

REGEX is case sensitive.

Can you make the query without looking the log or the result? 

I can't.