CODEWITHSUNDEEP
searchsplunksplunk-query
Gaurav Agrahari
Gaurav Agrahari

Reputation: 29

Splunk subsearch for regex outputs

I want a single search query for below splunk query.

First search will give me a dynamic field myorderid

index=mylog "trigger.rule: Id - * : Unexpected System Error" | rex field=_raw "Id -""(?[^:]*)" | table myorderid

I want to pass the above myorderid in below search criteria

index=mylog API=Order orderid=myorderid

Can anyone please help me to create a single query using subsearch in splunk.

Upvotes: 0

Views: 815

Answers (1)

RichG
RichG

Reputation: 9916

Have you tried the obvious?

index=mylog API=Order orderid=
[ search index=mylog "trigger.rule: Id - * : Unexpected System Error" 
    | rex "Id - (?<myorderid>[^:]*)" | fields myorderid ]

Upvotes: 1

Related Questions