Nested search to find the result

[bharatkalra]

Hi,

I have come across a situation where I have a search string to find error id, then I need to search that error id alone as search string and from the list of events, last one contains email address of the user which is what I need.
So
Query 1: | rex field=_raw "ErrorId:(?(\d|\w)+-(\d|\w)+-(\d|\w)+-(\d|\w)+-(\d|\w)+-(\d|\w)+)"
This gives me an error ID which is the input for my next query.
Query 2: EID
This gives me list of events with respect to the EID. From these events, last one contains the email address of the user. It should be repeated for all the EIDs that are collected in Query 1.

I thought of transaction command but it doesn't fit due to being different searches altogether.

Can somebody help please?

Thanks in advance!!!

[kristian_kolb]

Use a subsearch;

sourcetype=blah [search <search_string> | rex field=_raw "ErrorId:(?<eid>match your eid here)"| fields + eid] | the rest of your search here 

The subsearch (in square brackets) gets evaluated first, and sends back the eid=value to the outer search, where it is added as a search term. Note that there is no pipe before the subsearch.

/K

[bharatkalra]

Hi Kristian,

Thank you for responding. I tried your suggestion to find the result, subquery is running perfectly fine. But the thing is that eid is having more than one values, so the rest of search is not going along with it.

Is it possible to search each eid seperately with the rest of query? I think that would give me the desired result.

Thanks again!!

[Ayn]

This is pretty much a classic example of when to use subsearches. The docs really say it best with examples of how to use it: http://docs.splunk.com/Documentation/Splunk/6.0/SearchTutorial/Useasubsearch

[kristian_kolb]

I spend too much time editing....