Splunk Search

first query table output as input to another query

vadlamudi
Explorer

Hello,

 

Can i please know how to parse the value to the 2nd query from the output of 1st query. Any help would be appreciated.

 

1st query:

index=<index_name>  sourcetype=<sourcetype_name> | table k8s_label | where k8s_label="id=<id_number>"

 

1st Query Output:

name=peter
project_id=123
user_id=2700835661
zone=us-west-2a

 

2nd Query:

index=<index_name>  "server failed" Project_id=<need to get project_id  from the result of 1st query Output>

 

 

Thanks

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

From your description it looks like your k8s_label is a field containing 4 lines of data, each line represents a field of its own. However, your where statement in your first query references 'id=<xxx>" where there is no id= component in that text.

What do you want as your final output?

However, in terms of using one query to filter another you can use a subsearch, e.g.

index=<index_name>  "server failed" [
    search index=<index_name>  sourcetype=<sourcetype_name> 
    | rex field=k8s_label "(?s)project_id=(?<Project_id>\d+)"
    | fields Project_id
]

 which will use the Project_id from the subsearch as a filter to the outer search for server failed, but I am not clear if this is what you need. Can you clarify your data and expected output.

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...