Hello.
I have a search that looks for event id's that are the result of a regex:
index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.datablick.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid
This runs successfully. I would then like to use these event id's in a subsearch to pull out all events with those id's, not just the Quarantined ones. I tried a subsearch first:
index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.datablick.com" |rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid [ index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.datablick.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid ]
and then tried a join:
index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.visa.com" |rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid | join eventid search [ index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.visa.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid ]
But I keep getting the error "unknown search command index" What am I doing wrong?
Your join syntax is incorrect
it should be
... | join eventid [search index=ap...... ]
So finally your query looks like:
index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.visa.com" |rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid | join eventid [search index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.visa.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid ]
Your join syntax is incorrect
it should be
... | join eventid [search index=ap...... ]
So finally your query looks like:
index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.visa.com" |rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid | join eventid [search index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.visa.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid ]
Thank you!