https://community.splunk.com/t5/Splunk-Search/How-to-integrate-dbxquery-query-with-Splunk-search/m-p/514432#M144377 Tue, 18 Aug 2020 14:49:13 GMT aditsss 2020-08-18T14:49:13Z https://community.splunk.com/t5/Splunk-Search/How-to-integrate-dbxquery-query-with-Splunk-search/m-p/514349#M144354 <P>&nbsp;</P><P>&nbsp;</P> Tue, 18 Aug 2020 14:46:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-integrate-dbxquery-query-with-Splunk-search/m-p/514349#M144354 aditsss 2020-08-18T14:46:39Z https://community.splunk.com/t5/Splunk-Search/How-to-integrate-dbxquery-query-with-Splunk-search/m-p/514432#M144377 Tue, 18 Aug 2020 14:49:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-integrate-dbxquery-query-with-Splunk-search/m-p/514432#M144377 aditsss 2020-08-18T14:49:13Z https://community.splunk.com/t5/Splunk-Search/How-to-integrate-dbxquery-query-with-Splunk-search/m-p/514439#M144383 <P>Patience, Grasshopper.&nbsp; You posted on a Sunday when most users are living their lives rather than hanging out here.&nbsp; Even on work days, it may take a while to get an answer, especially when the question doesn't describe the desired result.</P><P>Have you tried using <FONT face="courier new,courier">append</FONT> to combine the two queries?</P><LI-CODE lang="markup">|dbxquery query="SELECT \"id\", \"name\", \"chain\" FROM flows;" connection="Postgres" | append [ search index=xyz sourcetype=xy source="logs" groups (CLIENT_Id ="*") |rex field=Request_URL "\/(?&lt;Group&gt;[^\/]+)$" | convert timeformat="%Y-%m-%d" ctime(_time) AS Date | stats count by Date CLIENT_Id GroupRequest_URL | sort - CLIENT_Id | rename Group as id ] | stats values(*) as * by id</LI-CODE><P>&nbsp;</P> Mon, 17 Aug 2020 12:07:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-integrate-dbxquery-query-with-Splunk-search/m-p/514439#M144383 richgalloway 2020-08-17T12:07:53Z https://community.splunk.com/t5/Splunk-Search/How-to-integrate-dbxquery-query-with-Splunk-search/m-p/514447#M144386 Tue, 18 Aug 2020 14:47:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-integrate-dbxquery-query-with-Splunk-search/m-p/514447#M144386 aditsss 2020-08-18T14:47:50Z https://community.splunk.com/t5/Splunk-Search/How-to-integrate-dbxquery-query-with-Splunk-search/m-p/514451#M144389 Remove the final stats command and check the results to see if the DB fields are present. Mon, 17 Aug 2020 13:05:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-integrate-dbxquery-query-with-Splunk-search/m-p/514451#M144389 richgalloway 2020-08-17T13:05:50Z