Splunk Search

How to input the value of key from the second search result in the "in" clause of "where" of the first search?

sramya
New Member

HI
I want to write a query like this

index=* "searchString1" | where in ([search "searchString2" | field key]) 

It may be incorrect syntax but let me explain that:

suppose the "index=* "searchString1" returns

"it is good abc"
"it is good def"
"it is good you"

and the "index=* "searchString2" returns

"I am bad key=abc"
"i am fine key=def"
"I am better key= fat"

Now my goal is to input the value of key from the second search result in the "in" clause of "where" of the first search so the output of looks like this.

"it is good abc"
"it is good def"

Is it possible is splunk?
It is kind of a nested sql query.
I am quite new to splunk so need some help.

Saurabh

Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index=* "searchString1" | where [search index=* "searchString2" | stats count by key | table key]

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index=* "searchString1" | where [search index=* "searchString2" | stats count by key | table key]
0 Karma

xpac
SplunkTrust
SplunkTrust

Wouldn't it actually be easier like this?

index=* "searchString1" [index=* "searchString2" | stats count by key | fields key] 
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...