Splunk Search

how do I use regular expression search results from one index search and use it in another?

krishna81m
Engager

How do I use regular expression search results from one index search and use it in another? The following does not work

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | fields my_nonce]

I followed this example at https://answers.splunk.com/answers/65336/how-do-i-use-the-output-from-one-serch-as-input-to-another....

index=other_index [search index=ironmail some_search_string | fields email_address ]

Tags (1)
0 Karma
1 Solution

Murali2888
Communicator

You can use the below as well.

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | rename my_nonce as query | fields query]

For example, if my_nonce has values like foo and bar, the query will return

host=*rest*  "foo" OR "bar"

View solution in original post

Murali2888
Communicator

You can use the below as well.

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | rename my_nonce as query | fields query]

For example, if my_nonce has values like foo and bar, the query will return

host=*rest*  "foo" OR "bar"

Murali2888
Communicator

Can you accept if either of the answers worked for you?

0 Karma

somesoni2
Revered Legend

Does your main search has a field called my_nonce?? If yes then your source should work fine (provided subsearch works fine). If there is no my_nonce field and you want to do a text search try this.

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | stats count by my_nonce | table my_nonce | rename my_nonce as search ]
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You can try

 host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" |return my_nonce]

You can also modify this a bit to use return $my_nonece, and modify the search to be

host="*rest*" my_nonce=[ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" |return $my_nonce]

Using $ will return the actual value, where as return itself will throw back the full field.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Return

Be aware of the behavior of return, as it uses head to return the first result.

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...