https://community.splunk.com/t5/Splunk-Search/Combine-2-searches-into-table-one-is-a-stats/m-p/119010#M31875 <P>Try this</P> <PRE><CODE>index=collaboration sourcetype="mail-2" UBL | stats count by simta_ublauthuser simta_ublstatus | rename simta_ublauthuser as user | join type=inner max=0 user [ search index=collaboration sourcetype="mail-2" Auth | dedup simta_client_ip | eval user = simta_smtp_authuser | fields user simta_client_ip ] | geoip simta_client_ip | sort user simta_client_ip | table user simta_client_ip simta_client_ip_country_name simta_client_ip_city simta_ublstatus count </CODE></PRE> Tue, 29 Oct 2013 00:36:26 GMT lguinn2 2013-10-29T00:36:26Z https://community.splunk.com/t5/Splunk-Search/Combine-2-searches-into-table-one-is-a-stats/m-p/119009#M31874 <P>Hello <BR /> I have the following searches below. The simta_smtp_authuser is the same username as the simta_ublauthuser of the second search.<BR /><BR /> What Im trying to do is include the stat results from search 2 into the table of search 1 and rename the simta_ublauthuser to simta_smtp_authuser so that sorting will group everything together. </P> <P>index=collaboration sourcetype="mail-2" Auth [search index=collaboration sourcetype="mail-2" | fields simta_ublauthuser | dedup simta_ublauthuser | return 500 $simta_ublauthuser] | fields simta_client_ip simta_smtp_authuser | dedup simta_client_ip | geoip simta_client_ip | sort simta_smtp_authuser simta_client_ip | table simta_smtp_authuser simta_client_ip simta_client_ip_country_name simta_client_ip_city</P> <P>thanks a bunch everyone. hope that makes sense.</P> <P>index=collaboration sourcetype="mail-2" UBL | stats count by simta_ublauthuser simta_ublstatus </P> Mon, 28 Sep 2020 15:06:57 GMT https://community.splunk.com/t5/Splunk-Search/Combine-2-searches-into-table-one-is-a-stats/m-p/119009#M31874 brywilk_umich 2020-09-28T15:06:57Z https://community.splunk.com/t5/Splunk-Search/Combine-2-searches-into-table-one-is-a-stats/m-p/119010#M31875 <P>Try this</P> <PRE><CODE>index=collaboration sourcetype="mail-2" UBL | stats count by simta_ublauthuser simta_ublstatus | rename simta_ublauthuser as user | join type=inner max=0 user [ search index=collaboration sourcetype="mail-2" Auth | dedup simta_client_ip | eval user = simta_smtp_authuser | fields user simta_client_ip ] | geoip simta_client_ip | sort user simta_client_ip | table user simta_client_ip simta_client_ip_country_name simta_client_ip_city simta_ublstatus count </CODE></PRE> Tue, 29 Oct 2013 00:36:26 GMT https://community.splunk.com/t5/Splunk-Search/Combine-2-searches-into-table-one-is-a-stats/m-p/119010#M31875 lguinn2 2013-10-29T00:36:26Z https://community.splunk.com/t5/Splunk-Search/Combine-2-searches-into-table-one-is-a-stats/m-p/119011#M31876 <P>thanks. Its close its just seems to be missing the different simta_client_ip's. looks like it grabs the first one and seems to stop.</P> <P>The simta_client_ip will usually be a couple (depending on if the account is used by a spammer from multiple locations). The simta_ublstatus will be the same for the user</P> Mon, 28 Sep 2020 15:07:00 GMT https://community.splunk.com/t5/Splunk-Search/Combine-2-searches-into-table-one-is-a-stats/m-p/119011#M31876 brywilk_umich 2020-09-28T15:07:00Z https://community.splunk.com/t5/Splunk-Search/Combine-2-searches-into-table-one-is-a-stats/m-p/119012#M31877 <P>I updated the answer and added <CODE>max=0</CODE> to the <CODE>join</CODE> command. This should fix the problem, I hope.</P> Tue, 29 Oct 2013 17:20:20 GMT https://community.splunk.com/t5/Splunk-Search/Combine-2-searches-into-table-one-is-a-stats/m-p/119012#M31877 lguinn2 2013-10-29T17:20:20Z