I don't think you are looking to join two searches because the two searches operate on the same data source and in the same time interval. What you want is to connect a transaction request and an OR...
See more...
I don't think you are looking to join two searches because the two searches operate on the same data source and in the same time interval. What you want is to connect a transaction request and an ORA-00001 error if it happens. ORA-00001, if it happens, should be directly following that transaction request. (Otherwise your problem is unsolvable.) The _raw field in your last output actually represents the error message you want to display, not so much raw events. In other words, from the data you illustrated, you want something like _time transaction_id error_log 2024-06-14 04:35:50 48493009394940303 240614 04:35:52 Algorithm: TS8398 hs_handle_base_rqst_msg: Details of ABC error ReSubResult:-1,FinalStatus:H,ErrorCode:-1,chLogMsg:SQL CODE IS -1 AND SQLERRM IS ORA-00001: unique constraint (INSTANCE.IDX_TS_UAT_ABC_ROW_ID) violated,LogDiscription: (Important: When you say "output as", you should illustrate actual output (anonymize as needed) of a search, not just field names.) This should get what you wanted: index=test_index source=/test/instance ("<=== Recv'd TRN:" OR "ORA-00001")
| rex field=_raw "\<=== Recv'd TRN:\s+(?<transaction_id>\w+)"
| transaction startswith="<=== Recv'd TRN:" endswith="ORA-00001" maxevents=2
| fields _* transaction_id
| eval error_log = split(_raw, "
")
| mvexpand error_log
| where match(error_log, "ORA-00001")
| table _time transaction_id error_log For this type of problem, transaction is appropriate. Here is an emulation for you to play with and compare with real data: | makeresults
| eval data = mvappend("240614 04:35:50 Algorithm: Al10: <=== Recv'd TRN: 48493009394940303 (TQ_HOST -> TQ_HOST)",
"240614 04:35:52 Algorithm: TS8398 hs_handle_base_rqst_msg: Error Executing CompareRBSrules Procedure.",
"240614 04:35:52 Algorithm: TS8398 hs_handle_base_rqst_msg: Details of ABC error ReSubResult:-1,FinalStatus:H,ErrorCode:-1,chLogMsg:SQL CODE IS -1 AND SQLERRM IS ORA-00001: unique constraint (INSTANCE.IDX_TS_UAT_ABC_ROW_ID) violated,LogDiscription:")
| mvexpand data
| rename data AS _raw
| rex "^(?<_time>\S+ \S+)"
| eval _time = strptime(_time, "%y%m%d %T")
| sort - _time
``` the above emulates
index=test_index source=/test/instance ("<=== Recv'd TRN:" OR "ORA-00001")
```