https://community.splunk.com/t5/Splunk-Search/SPL-Help-for-below-scenerio/m-p/496596#M138382 <P>@vikram1583 can you provide more detail about this? Maybe include an example</P> Mon, 16 Mar 2020 23:39:40 GMT anmolpatel 2020-03-16T23:39:40Z https://community.splunk.com/t5/Splunk-Search/SPL-Help-for-below-scenerio/m-p/496595#M138381 <P>search 1...|table src_ip<BR /> search 2: tag=authentication user!=*$ src_ip=xx.xx.xx.xx<BR /> | head 1<BR /> | table user src_ip </P> <P>from search 1 result i need to find user so i have search 2 to find that but i want to show both results in one search i tried like this <BR /> search1....| table src_ip | join type=left src_ip [|search tag=authentication user!=*$ src_ip=$src_ip$ | head 1<BR /> | table user src_ip <BR /> but not able to find result can some one help</P> Wed, 30 Sep 2020 04:38:49 GMT https://community.splunk.com/t5/Splunk-Search/SPL-Help-for-below-scenerio/m-p/496595#M138381 vikram1583 2020-09-30T04:38:49Z https://community.splunk.com/t5/Splunk-Search/SPL-Help-for-below-scenerio/m-p/496596#M138382 <P>@vikram1583 can you provide more detail about this? Maybe include an example</P> Mon, 16 Mar 2020 23:39:40 GMT https://community.splunk.com/t5/Splunk-Search/SPL-Help-for-below-scenerio/m-p/496596#M138382 anmolpatel 2020-03-16T23:39:40Z https://community.splunk.com/t5/Splunk-Search/SPL-Help-for-below-scenerio/m-p/496597#M138383 <P>You were close. The subsearch should not try to match events itself - the <CODE>join</CODE> will do that.</P> <PRE><CODE>search1....| fields src_ip | join type=left src_ip [|search tag=authentication user!=*$ | stats values(user) as user by src_ip] | table user src_ip </CODE></PRE> Tue, 17 Mar 2020 00:59:13 GMT https://community.splunk.com/t5/Splunk-Search/SPL-Help-for-below-scenerio/m-p/496597#M138383 richgalloway 2020-03-17T00:59:13Z