https://community.splunk.com/t5/Splunk-Search/Merge-two-searches-that-use-two-different-sourcetypes/m-p/429968#M122940 <P>Rich - I would like the results to be: _time, owner, dns, Risk, Name, signature_id, severity_id, plugin_Count, Solution, "See Also". Then from the dashboard the sysadmin can select the owner and sort just on their asset findings.</P> Tue, 29 Sep 2020 23:37:30 GMT bewald_cfi 2020-09-29T23:37:30Z https://community.splunk.com/t5/Splunk-Search/Merge-two-searches-that-use-two-different-sourcetypes/m-p/429966#M122938 <P>I have two searches from two different sourcetypes. Search #1 is currently in a dashboard with a dropdown selection. I would like to merge both searches into one and still utilize the dropdown selection. Is this possible?</P> <P>Search #1<BR /> sourcetype=Signature host="my_scanner"<BR /><BR /> | rename extracted_system AS dns<BR /> | join dns [ | inputlookup computers.csv Where owner="*"] <BR /> | table _time, owner, dns, Risk, Name, CVE, Solution, "See Also"<BR /> | rename dns AS Host</P> <P>Search #2<BR /> sourcetype=scans <BR /> | rename dest_ip TO dns <BR /> | search severity_id&gt;0 <BR /> | stats count AS plugin_Count BY dns, signature_id, severity_id <BR /> | search plugin_Count&gt;1 <BR /> | lookup computers.csv ip AS dns OUTPUT nt_host AS hostname, owner AS sysadmin <BR /> | sort severity_id, sysadmin, hostname <BR /> | table sysadmin, hostname, dns, signature_id, severity_id, plugin_Count</P> Tue, 29 Sep 2020 23:37:27 GMT https://community.splunk.com/t5/Splunk-Search/Merge-two-searches-that-use-two-different-sourcetypes/m-p/429966#M122938 bewald_cfi 2020-09-29T23:37:27Z https://community.splunk.com/t5/Splunk-Search/Merge-two-searches-that-use-two-different-sourcetypes/m-p/429967#M122939 <P>What do you want the combined search to generate as output?</P> Tue, 12 Mar 2019 21:06:50 GMT https://community.splunk.com/t5/Splunk-Search/Merge-two-searches-that-use-two-different-sourcetypes/m-p/429967#M122939 richgalloway 2019-03-12T21:06:50Z https://community.splunk.com/t5/Splunk-Search/Merge-two-searches-that-use-two-different-sourcetypes/m-p/429968#M122940 <P>Rich - I would like the results to be: _time, owner, dns, Risk, Name, signature_id, severity_id, plugin_Count, Solution, "See Also". Then from the dashboard the sysadmin can select the owner and sort just on their asset findings.</P> Tue, 29 Sep 2020 23:37:30 GMT https://community.splunk.com/t5/Splunk-Search/Merge-two-searches-that-use-two-different-sourcetypes/m-p/429968#M122940 bewald_cfi 2020-09-29T23:37:30Z