topic Show multi values in Splunk Search https://community.splunk.com/t5/Splunk-Search/Show-multi-values/m-p/554096#M157301 <P>Hi, i am a beginner.</P><P>I have 2 sourcetype (table). One of conatins requirement_id other ones conatins Testcase_id and requirement_id.</P><P>Must have: Join Testcase_id sourcetype to Requirement_id</P><P>&nbsp;</P><P>Note: Sorting (ordering of Testcase_id sourcetype is not a solution, because requirment_id souercetype&nbsp; table contains many other important attribute which is missing Testcase_id sourcetype.</P><TABLE border="1" width="24.463383838383837%"><TBODY><TR><TD width="50%">Requirement id</TD></TR><TR><TD width="50%">1</TD></TR><TR><TD width="50%">2</TD></TR><TR><TD>3</TD></TR><TR><TD>4</TD></TR><TR><TD>5</TD></TR></TBODY></TABLE><TABLE border="1" width="100%"><TBODY><TR><TD width="50%" height="25px">Testcase_id</TD><TD width="50%" height="25px">Requirement_id</TD></TR><TR><TD width="50%" height="25px">14</TD><TD width="50%" height="25px">1</TD></TR><TR><TD width="50%" height="25px">14</TD><TD width="50%" height="25px">2</TD></TR><TR><TD width="50%" height="25px">14</TD><TD width="50%" height="25px">3</TD></TR><TR><TD width="50%" height="25px">87</TD><TD width="50%" height="25px">1</TD></TR><TR><TD width="50%">87</TD><TD width="50%">2</TD></TR><TR><TD width="50%">87</TD><TD width="50%">3</TD></TR><TR><TD width="50%">76</TD><TD width="50%">4</TD></TR><TR><TD width="50%">67</TD><TD width="50%">4</TD></TR><TR><TD width="50%" height="25px">45</TD><TD width="50%" height="25px">5</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>My Expectation:</P><TABLE border="1" width="99.74210197710717%"><TBODY><TR><TD width="49.93548387096774%">Requirement_id</TD><TD width="49.93548387096774%">Testcase_id</TD></TR><TR><TD width="49.93548387096774%">1</TD><TD width="49.93548387096774%">14</TD></TR><TR><TD width="49.93548387096774%">1</TD><TD width="49.93548387096774%">87</TD></TR><TR><TD>2</TD><TD>14</TD></TR><TR><TD>2</TD><TD>87</TD></TR><TR><TD>3</TD><TD>14</TD></TR><TR><TD>3</TD><TD>87</TD></TR><TR><TD>4</TD><TD>76</TD></TR><TR><TD>4</TD><TD>67</TD></TR><TR><TD>5</TD><TD>45</TD></TR></TBODY></TABLE> Wed, 02 Jun 2021 12:53:07 GMT kig121 2021-06-02T12:53:07Z Show multi values https://community.splunk.com/t5/Splunk-Search/Show-multi-values/m-p/554096#M157301 <P>Hi, i am a beginner.</P><P>I have 2 sourcetype (table). One of conatins requirement_id other ones conatins Testcase_id and requirement_id.</P><P>Must have: Join Testcase_id sourcetype to Requirement_id</P><P>&nbsp;</P><P>Note: Sorting (ordering of Testcase_id sourcetype is not a solution, because requirment_id souercetype&nbsp; table contains many other important attribute which is missing Testcase_id sourcetype.</P><TABLE border="1" width="24.463383838383837%"><TBODY><TR><TD width="50%">Requirement id</TD></TR><TR><TD width="50%">1</TD></TR><TR><TD width="50%">2</TD></TR><TR><TD>3</TD></TR><TR><TD>4</TD></TR><TR><TD>5</TD></TR></TBODY></TABLE><TABLE border="1" width="100%"><TBODY><TR><TD width="50%" height="25px">Testcase_id</TD><TD width="50%" height="25px">Requirement_id</TD></TR><TR><TD width="50%" height="25px">14</TD><TD width="50%" height="25px">1</TD></TR><TR><TD width="50%" height="25px">14</TD><TD width="50%" height="25px">2</TD></TR><TR><TD width="50%" height="25px">14</TD><TD width="50%" height="25px">3</TD></TR><TR><TD width="50%" height="25px">87</TD><TD width="50%" height="25px">1</TD></TR><TR><TD width="50%">87</TD><TD width="50%">2</TD></TR><TR><TD width="50%">87</TD><TD width="50%">3</TD></TR><TR><TD width="50%">76</TD><TD width="50%">4</TD></TR><TR><TD width="50%">67</TD><TD width="50%">4</TD></TR><TR><TD width="50%" height="25px">45</TD><TD width="50%" height="25px">5</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>My Expectation:</P><TABLE border="1" width="99.74210197710717%"><TBODY><TR><TD width="49.93548387096774%">Requirement_id</TD><TD width="49.93548387096774%">Testcase_id</TD></TR><TR><TD width="49.93548387096774%">1</TD><TD width="49.93548387096774%">14</TD></TR><TR><TD width="49.93548387096774%">1</TD><TD width="49.93548387096774%">87</TD></TR><TR><TD>2</TD><TD>14</TD></TR><TR><TD>2</TD><TD>87</TD></TR><TR><TD>3</TD><TD>14</TD></TR><TR><TD>3</TD><TD>87</TD></TR><TR><TD>4</TD><TD>76</TD></TR><TR><TD>4</TD><TD>67</TD></TR><TR><TD>5</TD><TD>45</TD></TR></TBODY></TABLE> Wed, 02 Jun 2021 12:53:07 GMT https://community.splunk.com/t5/Splunk-Search/Show-multi-values/m-p/554096#M157301 kig121 2021-06-02T12:53:07Z Re: Show multi values https://community.splunk.com/t5/Splunk-Search/Show-multi-values/m-p/554098#M157303 <LI-CODE lang="markup">search test case | join requirement_id [search requirements] | sort requirement_id</LI-CODE> Wed, 02 Jun 2021 13:21:40 GMT https://community.splunk.com/t5/Splunk-Search/Show-multi-values/m-p/554098#M157303 ITWhisperer 2021-06-02T13:21:40Z Re: Show multi values https://community.splunk.com/t5/Splunk-Search/Show-multi-values/m-p/554099#M157304 <P>Hi</P><P>you could try the next</P><LI-CODE lang="markup">Index IN (&lt;IDX 1&gt;, … &lt;IDX 2&gt;) sourcetype IN (st1, st2) | stats values(*) as * by Requirement_id, Testcase_id | sort Requirement_id</LI-CODE><P>r. Ismo&nbsp;</P> Wed, 02 Jun 2021 13:27:18 GMT https://community.splunk.com/t5/Splunk-Search/Show-multi-values/m-p/554099#M157304 isoutamo 2021-06-02T13:27:18Z