I am trying the following query. However, activityId is not being passed to the second query and I am not having any results.
index=kubernetes lineOfBusiness=ifm component=chub useCase=C5 responsePayload
| rex field=_raw "imsiActivationDate\"\:\"(?<imsiActivationDate>[^\"]*)"
| rex field=_raw "simChangeDate\"\:\"(?<simChangeDate>[^\"]*)"
| rex field=_raw "activity-id=(?<activityId>[^||]*)"
| table activityId | map search="index=kubernetes lineOfBusiness=ifm component=ifm activity-id=*$activityId$*" | rex field=_raw "msisdn":"=(?<msisdn>[^=]*)" | dedup activityId, msisdn
| table activityId msisdn
Hi @irvindominguezs,
Can you try below?
index=kubernetes lineOfBusiness=ifm component=chub useCase=C5 responsePayload
| rex field=_raw "imsiActivationDate\"\:\"(?<imsiActivationDate>[^\"]*)"
| rex field=_raw "simChangeDate\"\:\"(?<simChangeDate>[^\"]*)"
| rex field=_raw "activity-id=(?<activityId>[^||]*)"
| table activityId | map search="search index=kubernetes lineOfBusiness=ifm component=ifm activity-id=*$activityId$*" | rex field=_raw "msisdn":"=(?<msisdn>[^=]*)" | dedup activityId, msisdn
| table activityId msisdn
hi @irvindominguezs,
Instead of using the map command, you can use the first/main search as a sub search to filter activityId in the second search.
index=kubernetes lineOfBusiness=ifm component=ifm activity-id IN([| search index=kubernetes lineOfBusiness=ifm component=chub useCase=C5 responsePayload | rex field=_raw "activity-id=(?<activityId>[^||]*)" | eval activityId="*".activityId."*" | stats values(activityId) as re | return $re]) | rex field=_raw "msisdn":"=(?<msisdn>[^=]*)" | dedup activityId, msisdn
| table activityId msisdn
If this reply helps you, a like would be appreciated.
Hello,
It did not work. I am still getting 0 results.