https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139882#M38509 <P>Use join option "type=left" to get unmatched requests.</P> Thu, 24 Apr 2014 14:47:42 GMT somesoni2 2014-04-24T14:47:42Z https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139876#M38503 <P>I have the following search pipeline</P> <P>search field1=xxxx | map search="search field2=yyyy field3=$file2$"</P> <P>When I run it I only get as output the results from "search field2=yyyy field3=$file2$" for each result in the main search. Is it somehow possible to get in the output the events resulting from "search field1=xxxx" too without having to append them like this?</P> <P>search field1=xxxx | map search="search field2=yyyy field3=$file2$" | append [ search field1=xxxx ]</P> Wed, 23 Apr 2014 10:31:01 GMT https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139876#M38503 mevcloud 2014-04-23T10:31:01Z https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139877#M38504 <P>What's your use case?</P> Wed, 23 Apr 2014 13:54:40 GMT https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139877#M38504 martin_mueller 2014-04-23T13:54:40Z https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139878#M38505 <P>My use case is the following one: I have to find a request and its matching response. Both the request and the response are xml messages. The response has an element called "MessageID" that contains a value that matches the value of another element called "RelatesTo" in the response. In the main search I look for the particular request I am looking for and extract the MessageID value using the rex command. I then using that $messageId$ in the map search to find the response. The problem is that using that I only get the response in the output and not the request.</P> Thu, 24 Apr 2014 08:59:20 GMT https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139878#M38505 mevcloud 2014-04-24T08:59:20Z https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139879#M38506 <P>I see... the most intuitive way would be to either use <CODE>join</CODE>:</P> <PRE><CODE>search for requests | do some extracting to get a field called MessageID | join MessageID [search for responses | do some extracting to get a field called MessageID] </CODE></PRE> <P>or to use <CODE>transaction</CODE>:</P> <PRE><CODE>search for requests OR responses | do some extracting on each to get a field called MessageID in both types of events | transaction MessageID </CODE></PRE> <P>Depending on your reporting after that, you may also be able to use <CODE>stats</CODE> instead of <CODE>transaction</CODE> like this:</P> <PRE><CODE> search for requests OR responses | do some extracting on each to get a field called MessageID in both types of events | stats some(reporting) as stuff by MessageID </CODE></PRE> Thu, 24 Apr 2014 10:39:37 GMT https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139879#M38506 martin_mueller 2014-04-24T10:39:37Z https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139880#M38507 <P>I had already tried the join exactly they way you mentioned in the answer and using it I am only getting the events on the left size (request) when there is a match and not both, as I would have expect from the description of the command.</P> Thu, 24 Apr 2014 12:53:41 GMT https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139880#M38507 mevcloud 2014-04-24T12:53:41Z https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139881#M38508 <P>You are getting fields from both sources. Don't use the event viewer tab to judge whether a join was successful, rather append a <CODE>table field1 field2 ...</CODE> and see if you're getting fields from both sources.</P> <P>The raw text of an event is just another field (<CODE>_raw</CODE>), so its behaviour after a join may not be as intuitively expected.</P> Thu, 24 Apr 2014 13:00:10 GMT https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139881#M38508 martin_mueller 2014-04-24T13:00:10Z https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139882#M38509 <P>Use join option "type=left" to get unmatched requests.</P> Thu, 24 Apr 2014 14:47:42 GMT https://community.splunk.com/t5/Splunk-Search/Get-main-search-resulting-events-in-the-output-when-using-map/m-p/139882#M38509 somesoni2 2014-04-24T14:47:42Z