I have a log file that comes from an email gateway (Ironmail). Each inbound message generates multple records within the log file. I need to be able to search for content in one of these records to obtain the common field in another record to retrive the results I need. Basically, using the output from one serch as input to another.
How can I do this in one step within Splunk?
Or, you could be speaking of a transaction. It depends on how you're trying to frame it, and the type of data you're dealing with.
http://docs.splunk.com/Documentation/Splunk/5.0/Search/Identifyandgroupeventsintotransactions
http://blogs.splunk.com/2012/11/05/book-excerpt-finding-specific-transactions/
What you are looking for is a sub search.
http://docs.splunk.com/Documentation/Splunk/5.0/Tutorial/Useasubsearch
Your subsearch will obtain the fields from the ironmail log which is then used as fields that are sent to the outer search.
example. index=other_index [search index=ironmail some_search_string | fields email_address ]