stuck on a subsearch

[dbcase]

Hi,

I have this query, what I'm trying to do is pull the mac address out of events with a 405 error dedup them then put them in a table. Then taking that table search the same index and match on mac address and pull out the external account id and finally put the mac address and external account id in a table. I can break apart the query and it seems to work, just not working when I put it together. Thoughts?

index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})"|rex "externalAccountId...(?<extref>\d+)"|table extref|where len(extref)<10|table mac extref

[somesoni2 · Accepted solution]

Try this

index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*"|rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})"  | search [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex "externalAccountId...(?<extref>\d+)"|where len(extref)<10| stats list(extref) AS "External Reference", values(mac) AS "Mac Address" BY mac

[dbcase]

Can you convert to answer?

[dbcase]

ahhhh search then [search

Thanks Somesoni2!!!

[dbcase]

failed attempt #2

index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})"|rex "externalAccountId...(?<extref>\d+)"|where len(extref)<10| stats list(extref) AS "External Reference", values(mac) AS "Mac Address" BY mac