paranthesis error in search query

[secure]

Hi,

Im trying to use an OR function in the below query trying to combine two indexes and then use stats function like an alternate for join command

(index=serverdata sourcetype="server:stats" | rex "app_code=\"(?<application_code>[|w.\"]*)" ) OR (index="hostapp" source=hostDB_Table dataasset="*host_Data*")

i have tried to use escape characters but its still not working

thanks 

[gcusello]

Hi @secure ,

as @PickleRick said, in the main search you cannot use a command as rex.

You have two choices:

move the rex after the main search:

(index=serverdata sourcetype="server:stats") OR (index="hostapp" source=hostDB_Table dataasset="*host_Data*")
| rex "app_code=\"(?<application_code>[|w.\"]*)"

or use append:

(index=serverdata sourcetype="server:stats" 
| rex "app_code=\"(?<application_code>[|w.\"]*)"
| append [ search index="hostapp" source=hostDB_Table dataasset="*host_Data*")]

This second solution runs only if you have, in the secondary search, less than 50,000 results, for this reason I orefer the first one.

In addition, there's a third solution that I prefer: if you create a fixed field extraction, using the regex, you don't need to insert it in the search and you can use only the main search:

(index=serverdata sourcetype="server:stats") OR (index="hostapp" source=hostDB_Table dataasset="*host_Data*")

Ciao.

Giuseppe

[PickleRick]

The 50k results limit for subsearch applies only to join! The default limit for a subsearch is 10k results.

[PickleRick]

It doesn't work like that. Parentheses group search conditions only. You can't spawn separate post-processing command for part of your data this way. You would need to use multisearch or append. But in your case it's probably not needed. Just do your rex command after the initial search.

Unrelated note - don't use wildcards at the beginning of your search term unless you really can't avoid it.

[NevilleRadcliff]

Thanks, I will keep it in mind.

[gcusello]

Hi @NevilleRadcliff ,

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉