Splunk Search

how do I use regular expression search results from one index search and use it in another?

krishna81m
Engager

How do I use regular expression search results from one index search and use it in another? The following does not work

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | fields my_nonce]

I followed this example at https://answers.splunk.com/answers/65336/how-do-i-use-the-output-from-one-serch-as-input-to-another....

index=other_index [search index=ironmail some_search_string | fields email_address ]

Tags (1)
0 Karma
1 Solution

Murali2888
Communicator

You can use the below as well.

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | rename my_nonce as query | fields query]

For example, if my_nonce has values like foo and bar, the query will return

host=*rest*  "foo" OR "bar"

View solution in original post

Murali2888
Communicator

You can use the below as well.

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | rename my_nonce as query | fields query]

For example, if my_nonce has values like foo and bar, the query will return

host=*rest*  "foo" OR "bar"

Murali2888
Communicator

Can you accept if either of the answers worked for you?

0 Karma

somesoni2
Revered Legend

Does your main search has a field called my_nonce?? If yes then your source should work fine (provided subsearch works fine). If there is no my_nonce field and you want to do a text search try this.

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | stats count by my_nonce | table my_nonce | rename my_nonce as search ]
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You can try

 host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" |return my_nonce]

You can also modify this a bit to use return $my_nonece, and modify the search to be

host="*rest*" my_nonce=[ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" |return $my_nonce]

Using $ will return the actual value, where as return itself will throw back the full field.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Return

Be aware of the behavior of return, as it uses head to return the first result.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...