Splunk Search

how do I use regular expression search results from one index search and use it in another?

krishna81m
Engager

How do I use regular expression search results from one index search and use it in another? The following does not work

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | fields my_nonce]

I followed this example at https://answers.splunk.com/answers/65336/how-do-i-use-the-output-from-one-serch-as-input-to-another....

index=other_index [search index=ironmail some_search_string | fields email_address ]

Tags (1)
0 Karma
1 Solution

Murali2888
Communicator

You can use the below as well.

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | rename my_nonce as query | fields query]

For example, if my_nonce has values like foo and bar, the query will return

host=*rest*  "foo" OR "bar"

View solution in original post

Murali2888
Communicator

You can use the below as well.

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | rename my_nonce as query | fields query]

For example, if my_nonce has values like foo and bar, the query will return

host=*rest*  "foo" OR "bar"

Murali2888
Communicator

Can you accept if either of the answers worked for you?

0 Karma

somesoni2
Revered Legend

Does your main search has a field called my_nonce?? If yes then your source should work fine (provided subsearch works fine). If there is no my_nonce field and you want to do a text search try this.

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | stats count by my_nonce | table my_nonce | rename my_nonce as search ]
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You can try

 host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" |return my_nonce]

You can also modify this a bit to use return $my_nonece, and modify the search to be

host="*rest*" my_nonce=[ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" |return $my_nonce]

Using $ will return the actual value, where as return itself will throw back the full field.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Return

Be aware of the behavior of return, as it uses head to return the first result.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...