https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501840#M139698 <P>Separate, both queries return results.</P> Fri, 27 Mar 2020 20:53:58 GMT LeandroKopke 2020-03-27T20:53:58Z https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501836#M139694 <P>Hi.<BR /> I need help to be able to unify 2 fields that have the same value, however, in separate searches.<BR /> Here is an example:</P> <P>Search 1: <BR /> source=* sourcetype=fortigate user=* action=tunnel-up reason="tunnel established"| table _time user group action remip reason tunnelip</P> <P>Search 2:<BR /> source=* sourcetype=fortigate dstport=6443 action=close |table srcip, srcintf</P> <P>The "srcip" and "remip" fields have the same values. I need both searches together, to be able to use the user field of the first search in the second search.</P> Fri, 27 Mar 2020 18:49:24 GMT https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501836#M139694 LeandroKopke 2020-03-27T18:49:24Z https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501837#M139695 <P>If search 1 returns 10,000 or fewer results, try a subsearch. Don't forget to specify index(es) in the searches.</P> <PRE><CODE>source=* sourcetype=fortigate dstport=6443 action=close [ source= sourcetype=fortigate user=* action=tunnel-up reason="tunnel established" | fields user remip | rename remip as srcip | format ] |table srcip, srcintf </CODE></PRE> Fri, 27 Mar 2020 19:06:28 GMT https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501837#M139695 richgalloway 2020-03-27T19:06:28Z https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501838#M139696 <P>hi richgalloway, thanks for you reply. <BR /> I did the execution of the command only, it doesn't return any results.<BR /> I've tried using append and join, but to no avail.</P> Fri, 27 Mar 2020 19:26:46 GMT https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501838#M139696 LeandroKopke 2020-03-27T19:26:46Z https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501839#M139697 <P>Keep in mind my answer is mostly a copy-and-paste of your example queries so any errors there are errors in mine as well.<BR /> Try running the subsearch (the part inside <CODE>[]</CODE> by itself. Once that is working correctly, add it to the main search.</P> Fri, 27 Mar 2020 19:49:02 GMT https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501839#M139697 richgalloway 2020-03-27T19:49:02Z https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501840#M139698 <P>Separate, both queries return results.</P> Fri, 27 Mar 2020 20:53:58 GMT https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501840#M139698 LeandroKopke 2020-03-27T20:53:58Z https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501841#M139699 <P>And when you paste the results of the subsearch onto the end of the main search, what do you get?</P> Fri, 27 Mar 2020 21:07:35 GMT https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501841#M139699 richgalloway 2020-03-27T21:07:35Z https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501842#M139700 <P>This does not make sense. Please explain what fields from what search are to be used to program details in what other search OR explain how data from both searches need to be merged together.</P> Wed, 01 Apr 2020 00:31:21 GMT https://community.splunk.com/t5/Splunk-Search/Join-2-fields-with-the-same-value-in-the-same-search/m-p/501842#M139700 woodcock 2020-04-01T00:31:21Z