https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-add-results-correlate-in-a-search-with-a-sub/m-p/382552#M111778 <P>I want to dynamically add fields to my result set depending on a search I did.</P> <P>How do I can add fields/new columns based on a search from a result of the main-search ? </P> <P>index=test<BR /> *<BR /> | table Computer<BR /> | appendcols [ search (index=another_test) Computer=$ParentSearch$.Computer) | head 1 | table Name ] <BR /> | table Computer, Name</P> <P>dynamically. I cant work with lookups for each result because I want to generate the end result each time.<BR /> Cant do that manually. I need to be to process this automatically.</P> <P>Another example:</P> <P>Lets say I am building a resultset with an query.<BR /> When results show up, how can I enrich my resultset with values from another index?</P> <P>What I am looking is at writing SPLs which run once and during this one-shot they should correlate multiply events from multiply indexes. So result should be further processed and enriched by information from other indexes/columns.</P> <P>What is the best way to do that with Splunk in one SPL ?</P> Tue, 09 Jul 2019 20:12:03 GMT bahndg 2019-07-09T20:12:03Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-add-results-correlate-in-a-search-with-a-sub/m-p/382552#M111778 <P>I want to dynamically add fields to my result set depending on a search I did.</P> <P>How do I can add fields/new columns based on a search from a result of the main-search ? </P> <P>index=test<BR /> *<BR /> | table Computer<BR /> | appendcols [ search (index=another_test) Computer=$ParentSearch$.Computer) | head 1 | table Name ] <BR /> | table Computer, Name</P> <P>dynamically. I cant work with lookups for each result because I want to generate the end result each time.<BR /> Cant do that manually. I need to be to process this automatically.</P> <P>Another example:</P> <P>Lets say I am building a resultset with an query.<BR /> When results show up, how can I enrich my resultset with values from another index?</P> <P>What I am looking is at writing SPLs which run once and during this one-shot they should correlate multiply events from multiply indexes. So result should be further processed and enriched by information from other indexes/columns.</P> <P>What is the best way to do that with Splunk in one SPL ?</P> Tue, 09 Jul 2019 20:12:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-add-results-correlate-in-a-search-with-a-sub/m-p/382552#M111778 bahndg 2019-07-09T20:12:03Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-add-results-correlate-in-a-search-with-a-sub/m-p/382553#M111779 <P>I do not understand much what I want to do</P> <P>For example, what about this search statement?</P> <PRE><CODE>(index=test OR index=another_test) |stats latest(Name) as Name by Computer </CODE></PRE> Wed, 10 Jul 2019 04:23:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-add-results-correlate-in-a-search-with-a-sub/m-p/382553#M111779 HiroshiSatoh 2019-07-10T04:23:14Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-add-results-correlate-in-a-search-with-a-sub/m-p/382554#M111780 <P>You are looking for the join command, i.e:</P> <P>index=test<BR /> | table Computer<BR /> | join Computer [ search (index=another_test) | head 1 | table Name Computer]</P> <P>This correlates the Computer field both on index test and another_test and join the subsearch fields (except for the matching one).</P> <P>Dont forget to upvote <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 10 Jul 2019 12:28:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-add-results-correlate-in-a-search-with-a-sub/m-p/382554#M111780 sonny_monti 2019-07-10T12:28:28Z