Hello,
Can i please know how to parse the value to the 2nd query from the output of 1st query. Any help would be appreciated.
1st query:
index=<index_name> sourcetype=<sourcetype_name> | table k8s_label | where k8s_label="id=<id_number>"
1st Query Output:
2nd Query:
index=<index_name> "server failed" Project_id=<need to get project_id from the result of 1st query Output>
Thanks
From your description it looks like your k8s_label is a field containing 4 lines of data, each line represents a field of its own. However, your where statement in your first query references 'id=<xxx>" where there is no id= component in that text.
What do you want as your final output?
However, in terms of using one query to filter another you can use a subsearch, e.g.
index=<index_name> "server failed" [
search index=<index_name> sourcetype=<sourcetype_name>
| rex field=k8s_label "(?s)project_id=(?<Project_id>\d+)"
| fields Project_id
]
which will use the Project_id from the subsearch as a filter to the outer search for server failed, but I am not clear if this is what you need. Can you clarify your data and expected output.