https://community.splunk.com/t5/Splunk-Search/Join-matching-field-of-a-Sub-Search/m-p/567019#M197595 <P>Hello, I currently have a search over <STRONG>index_A</STRONG> that runs a sub-search from <STRONG>index_B</STRONG> looking to match a field (<STRONG>field_B</STRONG>) from <STRONG>index_B</STRONG> to any log within <STRONG>index_A</STRONG>.&nbsp; The search works great but the only frustration is not knowing what field value that <STRONG>field_B</STRONG> held as all of the tabled results come from <STRONG>index_A</STRONG>.&nbsp; Is there a way I can join that matched <STRONG>field_B</STRONG> to the results at the end of the search?&nbsp; Here is my current search and thanks for anyone that has the time to help me with this!</P><LI-CODE lang="markup">index=index_A [search index=index_B | fields field_B | rename field_B as query] | table field_A field_A1 field_A2 field_A3</LI-CODE><P>&nbsp;</P> Tue, 14 Sep 2021 20:13:33 GMT epw0rrell 2021-09-14T20:13:33Z https://community.splunk.com/t5/Splunk-Search/Join-matching-field-of-a-Sub-Search/m-p/567019#M197595 <P>Hello, I currently have a search over <STRONG>index_A</STRONG> that runs a sub-search from <STRONG>index_B</STRONG> looking to match a field (<STRONG>field_B</STRONG>) from <STRONG>index_B</STRONG> to any log within <STRONG>index_A</STRONG>.&nbsp; The search works great but the only frustration is not knowing what field value that <STRONG>field_B</STRONG> held as all of the tabled results come from <STRONG>index_A</STRONG>.&nbsp; Is there a way I can join that matched <STRONG>field_B</STRONG> to the results at the end of the search?&nbsp; Here is my current search and thanks for anyone that has the time to help me with this!</P><LI-CODE lang="markup">index=index_A [search index=index_B | fields field_B | rename field_B as query] | table field_A field_A1 field_A2 field_A3</LI-CODE><P>&nbsp;</P> Tue, 14 Sep 2021 20:13:33 GMT https://community.splunk.com/t5/Splunk-Search/Join-matching-field-of-a-Sub-Search/m-p/567019#M197595 epw0rrell 2021-09-14T20:13:33Z