https://community.splunk.com/t5/Getting-Data-In/Fields-in-another-sourcetype/m-p/157779#M31967 <P>Hi,<BR /> I think that you can use the <STRONG>appendcols</STRONG> command to do that.<BR /> To have the resulting table you need you have to pipe the search that produce the first result without user and then you use appendcols [ ] .in the square brakets you put the search that will produce only the field user from WSA sourcetype.<BR /> At the end you pipe all and you can use table command to display what you wanted. just like this:</P> <P><STRONG>search from ASA sourcetype | appendcols [subsearch from WSA] |table timestamp scr_ip count user</STRONG> </P> Fri, 19 Dec 2014 11:30:38 GMT stephane_cyrill 2014-12-19T11:30:38Z https://community.splunk.com/t5/Getting-Data-In/Fields-in-another-sourcetype/m-p/157778#M31966 <P>Hi everyone:</P> <P>I have two sourcetypes: Cisco WSA, and Cisco ASA. WSA has user data, but ASA don't.<BR /> I want to have the users for every source ip (src_ip) for asa. I have DHCP.<BR /> I have for example, this:</P> <HR /> <P>ASA top src_ip</P> <P>timestamp ! src_ip ! count<BR /> a ! ip_a ! 2<BR /> b ! ip_b ! 5</P> <H2> c ! ip_c ! 7 </H2> <P>but I need this:</P> <P>ASA top src_ip</P> <P>timestamp ! src_ip ! count ! user<BR /> a ! ip_a ! 2 ! u1<BR /> b ! ip_b ! 2 ! u5<BR /> d ! ip_b ! 2 ! u2 <BR /> c ! ip_c ! 4 ! u1<BR /> e ! ip_c ! 3 ! u5</P> <HR /> <P>Do someone know how to do something like this?</P> Mon, 28 Sep 2020 18:26:26 GMT https://community.splunk.com/t5/Getting-Data-In/Fields-in-another-sourcetype/m-p/157778#M31966 rubeniturrieta 2020-09-28T18:26:26Z https://community.splunk.com/t5/Getting-Data-In/Fields-in-another-sourcetype/m-p/157779#M31967 <P>Hi,<BR /> I think that you can use the <STRONG>appendcols</STRONG> command to do that.<BR /> To have the resulting table you need you have to pipe the search that produce the first result without user and then you use appendcols [ ] .in the square brakets you put the search that will produce only the field user from WSA sourcetype.<BR /> At the end you pipe all and you can use table command to display what you wanted. just like this:</P> <P><STRONG>search from ASA sourcetype | appendcols [subsearch from WSA] |table timestamp scr_ip count user</STRONG> </P> Fri, 19 Dec 2014 11:30:38 GMT https://community.splunk.com/t5/Getting-Data-In/Fields-in-another-sourcetype/m-p/157779#M31967 stephane_cyrill 2014-12-19T11:30:38Z