I've tried it in your earlier suggestion, how do you want me to construct the search now? ... View more

Hi can you share example events so the community could help you.  You should change regex to rex and try again.  r. Ismo ... View more

Let's assume that you need the value from index=foo sourcetype=bar Field1 ="A" | fields Field1 Field2 Where the result happens to be Field1 Field2 A B in order to make this search happen index=foo sourcetype=baz Field3="B" | fields field3 Field4 and get the results Field3 Field4 B C There are at least two ways to link those searches. The first is with a subsearch to find the first results, then feed that to the second search. This is what @richgalloway showed you above. index=foo sourcetype=baz [ search index=foo sourcetype=bar Field1 ="A" | table Field2 | rename Field2 as Field3 ] | fields field3 Field4 The subsearch in square braces will return its result into the first search as ( Field3="B" ) . To see exactly what the first search returns, run that search standalone (without the word search ) and add on the end | format . the result text will be in a single variable called search . That's fairly efficient if you are only running a single result, or if there are very few records at any given time to contend with. However, if you wanted to match up large number of records, then you probably want to go with the "splunk soup" method. index=foo ( sourcetype=bar Field1 ="*") OR (sourcetype=baz Field3="*") | fields sourcetype Field1 Field2 Field3 Field4 | eval matchField= if(sourcetype="bar",Field2,Field3) | stats values(Field1) as Field1 values(Field4) as Field4 by matchField This will give you all the various matched up records, including one which looks like matchField Field1 Field4 B A C ... View more

This is helpful, but the dog_name can't be golden retriever, the word "Golden retriever" just might be found in the second search's log ... View more

Hi @splunkuser2127 Check this link for a clear explanation https://www.splunk.com/en_us/blog/tips-and-tricks/search-commands-stats-chart-and-timechart.html ... View more