I have two different searches. How do I concatenate them?
Search 1:
string1 | rex field=_raw "{(?\d+)"
Search 2:
string2 | rex field=_raw "needed * (?\d+)" | search runtime>5000
string1 != string2. What I want is to filter the results of search 2 by the item IDs found by search 1. How do I do it?
Hi Ben,
This is known as Sub-Searching, please see the link below which is the documentation for Sub searches.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Search/Aboutsubsearches
Hope it helps
Hi Ben,
This is known as Sub-Searching, please see the link below which is the documentation for Sub searches.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Search/Aboutsubsearches
Hope it helps
Helped me partly. Thanks
what I needed is furthermore was way of how to filter by all found field values. For this it is essential to differ between "rename my_field" as search and "rename my_field as query".
So the resulting query in my case would be:
string2* [|search string1 | rex field=_raw "{(?<my_field>-*\d+)"| rename my_field as query | fields query]* | rex field=_raw "needed * (?<runtime>\d+)" | search runtime>5000
Hi Ben,
Glad it helped.
Please vote up!