I need to run two sub searches. Each of these sub-searches will return a set of fields, one of them is called transactionNumber.
Then I want to the search to return only those results from the two sub-searches which have an equal transactionNumber.
How can I do this?
Use set
(http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Set):
| set intersect [search search1 | fields transactionNumber | fields - _*] [search search2 | fields transactionNumber | fields - _*]
If you want not just the transactionNumbers but also the actual events, you could feed this into a subsearch:
(search1) OR (search2) [| set intersect [search search1 | fields transactionNumber | fields - _*] [search search2 | fields transactionNumber | fields - _*] | fields transactionNumber ]
Use set
(http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Set):
| set intersect [search search1 | fields transactionNumber | fields - _*] [search search2 | fields transactionNumber | fields - _*]
If you want not just the transactionNumbers but also the actual events, you could feed this into a subsearch:
(search1) OR (search2) [| set intersect [search search1 | fields transactionNumber | fields - _*] [search search2 | fields transactionNumber | fields - _*] | fields transactionNumber ]