first query table output as input to another query

[vadlamudi]

Hello,

Can i please know how to parse the value to the 2nd query from the output of 1st query. Any help would be appreciated.

1st query:

index=<index_name>  sourcetype=<sourcetype_name> | table k8s_label | where k8s_label="id=<id_number>"

1st Query Output:

name=peter

project_id=123

user_id=2700835661

zone=us-west-2a

2nd Query:

index=<index_name>  "server failed" Project_id=<need to get project_id  from the result of 1st query Output>

Thanks

[bowesmana]

From your description it looks like your k8s_label is a field containing 4 lines of data, each line represents a field of its own. However, your where statement in your first query references 'id=<xxx>" where there is no id= component in that text.

What do you want as your final output?

However, in terms of using one query to filter another you can use a subsearch, e.g.

index=<index_name>  "server failed" [
    search index=<index_name>  sourcetype=<sourcetype_name> 
    | rex field=k8s_label "(?s)project_id=(?<Project_id>\d+)"
    | fields Project_id
]

 which will use the Project_id from the subsearch as a filter to the outer search for server failed, but I am not clear if this is what you need. Can you clarify your data and expected output.