topic Can you combine fields from multiple search in one table? in Splunk Search

Can you combine fields from multiple search in one table?

roopasree — Tue, 12 Jun 2018 12:55:11 GMT

I'm trying to combine fields in multiple search result in one output table as overall result, for example:

Search 1 result
Date,open ,close

Search 2 result
incident ,type1,result

Output table
Date,open ,close,incident ,type1,result

Hope question is clear

Thanks

Re: Can you combine fields from multiple search in one table?

pradeepkumarg — Tue, 12 Jun 2018 14:48:18 GMT

How will you know what rows from result 1 relate to what rows in result 2? Is there not a common field between the two datasets?

Re: Can you combine fields from multiple search in one table?

jowenssi — Tue, 12 Jun 2018 19:33:20 GMT

Sure, just use | appendcols

search foo | fields date,open,close | appendcols [ search bar | fields incident,type1,result]

http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Appendcols

Re: Can you combine fields from multiple search in one table?

PowerPacked — Tue, 12 Jun 2018 19:51:03 GMT

Hi @roopasree

There should be a common field in main & sub search to map the results correctly,

if you want to just append the columns use the above answer ----- appendcols, append commands should work for that.

if you want to map the results between main and sub search based on a specific field ----- join command should work for you.

main search | fields date,open,close,incidentnum | join incidentnum [search subsearch | fields incident,type1,result,incidentnum] | stats c by date,open,close,incidentnum,incident,type1,result

Thanks

Re: Can you combine fields from multiple search in one table?

roopasree — Wed, 13 Jun 2018 07:03:43 GMT

@gpradeepkumarreddy yes there is no comman field among two datasets