Hi
After a search I extracted the field "test_number". Now I would like to use those extracted field values to make a new search through different data which already contains the field "test_number". At the end, I am expecting to get the events from the new data that contains the same field values.
I think you're looking for subsearches.
<search terms for search 2> [ search <search terms for search 1> | table test_number]
The bracketed search will be run, and what will come out to the outer search in place of the bracketed expression will be something like (test_number=123 OR test_number=345 OR test_number=456)
http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Usesubsearchtocorrelateevents
However more generally if you aren't familiar with subsearches, you should start from the top and go through the Search manual. Subsearches are frequently overused by new Splunk users in places where other approaches would be simpler and faster.
http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Aboutsearch
or go through the tutorial. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchTutorial/WelcometotheSearchTutorial
I think you're looking for subsearches.
<search terms for search 2> [ search <search terms for search 1> | table test_number]
The bracketed search will be run, and what will come out to the outer search in place of the bracketed expression will be something like (test_number=123 OR test_number=345 OR test_number=456)
http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Usesubsearchtocorrelateevents
However more generally if you aren't familiar with subsearches, you should start from the top and go through the Search manual. Subsearches are frequently overused by new Splunk users in places where other approaches would be simpler and faster.
http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Aboutsearch
or go through the tutorial. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchTutorial/WelcometotheSearchTutorial