I have two queries which are working fine independently but I want to join those two and get the result in one go. Can you please help how to achieve that. Logs having session Id : 2016-03-15 09:31:40,083 INFO dsadsadjsakldjsalkdjaskldj **Test@123456789* (SessionId : 123456789 )* Query1 : index=test "Search String1" | rex "Test@(?<SessionId>[^<]+)" | table SessionId :- From This we are extracting all the session id's. Now we have to extract another value (IDNO) by checking logs for whole session using session id which is common in both queries. Log having both SessionId and IDNO : 2016-03-15 09:31:40,027 INFO sadasdjadjhasjkdhsakdjshakdjhsakdja Test@123456789 IDNO 747711680 Query2 : index=test "Search String2" SessionId | rex "IDNO (?[^<]+)" | table ID We have to print all ID values for corresponding sessionid values in last 24 hours. Thanks in advance ... View more

Hi All My search results from Splunk look like below 2015-11-13 06:32:33,949|a.abcd|DAS|callabcd():getTime|0.296|SUCCESS|Data : 254|1447414015145[B@8d7c046b8089602570758821847|null|null I want to extract the value 0.296 from this. Can you please let me know how to do this? I have already tried with below options and it doesn't work. Option 1: search_query | rex field=_raw "^([^|]+|){5} +(?<x>[^|]+)"| table x Option 2: search_query | rex field=_raw "^([^\|]+\|){5} +(?<x>[^\|]+)"| table x ... View more