Splunk Search

how do I use regular expression search results from one index search and use it in another?

krishna81m
Engager

How do I use regular expression search results from one index search and use it in another? The following does not work

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | fields my_nonce]

I followed this example at https://answers.splunk.com/answers/65336/how-do-i-use-the-output-from-one-serch-as-input-to-another....

index=other_index [search index=ironmail some_search_string | fields email_address ]

Tags (1)
0 Karma
1 Solution

Murali2888
Communicator

You can use the below as well.

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | rename my_nonce as query | fields query]

For example, if my_nonce has values like foo and bar, the query will return

host=*rest*  "foo" OR "bar"

View solution in original post

Murali2888
Communicator

You can use the below as well.

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | rename my_nonce as query | fields query]

For example, if my_nonce has values like foo and bar, the query will return

host=*rest*  "foo" OR "bar"

Murali2888
Communicator

Can you accept if either of the answers worked for you?

0 Karma

somesoni2
Revered Legend

Does your main search has a field called my_nonce?? If yes then your source should work fine (provided subsearch works fine). If there is no my_nonce field and you want to do a text search try this.

host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" | stats count by my_nonce | table my_nonce | rename my_nonce as search ]
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You can try

 host="*rest*" [ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" |return my_nonce]

You can also modify this a bit to use return $my_nonece, and modify the search to be

host="*rest*" my_nonce=[ search index=ws host="*ws*" sourcetype="WS*" (/service/click)  | rex field=_raw "^(?:(nonce)*){10}\s+\w+=(?P<my_nonce>.+)" |return $my_nonce]

Using $ will return the actual value, where as return itself will throw back the full field.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Return

Be aware of the behavior of return, as it uses head to return the first result.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...