search all another field from a search result of grouping by another field in another search

[krishna81m]

We have multiple TraceIDs that have same payload and this payload is part many logs for a given TraceID. Here foo1 is a common payload for multiple TraceIDs 1, 3, 4. Is it possible to search for all unique traceIDs 1, 2 only based on the payload, then get all of the logs for these traces?

Input:
TraceID Type             Name        Payload
1               HEADER     first            foo1
2               HEADER     first            foo2
3               HEADER     first            foo1
4               HEADER     first            foo1

Output:
TraceID Type             Name        Payload
1               HEADER     first            foo1
2               HEADER     first            foo2

You can get unique traceIds grouped by Payload using
stats max(traceId) as maxTraceId, min(traceId) as minTraceId by payload

Now, how do we feed the maxTraceId into another search? We need all of the logs for these TraceID 1, 2 only. These requests did not work.

some_search [ search some_search | stats max(traceId) as maxTraceId by payload | fields maxTraceId ]
some_search [ search some_search | streamstats max(traceId) as maxTraceId bypayload | fields maxTraceId ]
some_search | where traceId IN [ search some_search | stats max(traceId) as maxtraceId by paload | fields maxtraceId ]


TraceID Type             Name        Payload
1               HEADER     first            foo1
1               BODY           second     bar1
1               FOOTER      third           baz1
2               HEADER     first            foo2
2               BODY           second     bar2
2               FOOTER      third           baz2

[PickleRick]

It's not clear what you want to achieve. Just remember that if you return values from a subsearch they create additional conditions as if you literarily supplied all of those conditions at once.

So if your subsearch returns two TraceID fields, your main search after subsearch expansion will have form of

<<rest of the search>> (TraceID=val1 OR TraceID=val2)

If you want to run separate search for each of the TraceID values you might want to look into the map command.

[krishna81m]

:)., my example has as much details as I can give and why my subsearch examples did not work.

Its a simple search trying to find all unique values of fieldA and feed them into another search to give all logs containing these fieldA unique value.

Let me give subsearch using map a shot.