https://community.splunk.com/t5/Splunk-Search/How-to-display-another-field-with-subsearch/m-p/241846#M71938 <P>Try something like this</P> <PRE><CODE>source="test.csv" earliest=-mon@mo | table Serial "Last Week" | eval From=1 | append [search source="source1.csv" Status="Ship*" | table "Serial Number" OtherFieldThatYourWant | rename "Serial_Number" as Serial | eval From=2 ] | stats values(*) as * by Serial | where mvcount(From)=2 | table Serial "Last Week" OtherFieldThatYourWant </CODE></PRE> Mon, 28 Sep 2015 22:09:46 GMT somesoni2 2015-09-28T22:09:46Z https://community.splunk.com/t5/Splunk-Search/How-to-display-another-field-with-subsearch/m-p/241845#M71937 <P>Hi everyone, I have a question about a subsearch.<BR /> I have this query :</P> <P>source="test.csv" earliest=-mon@mon [search source="source1.csv" "Status"="Ship" | rename "Serial Number" AS "Serial" |table "Serial" ] | table "Serial" "Last Week"</P> <P>This search displays the serial numbers that are shipped and the date ("Last Week"). I want to display another field which is in "source1". <BR /> After having looked at some splunk answers I tried to add "fields" in the subsearch but it didn't work.</P> <P>Could you please help me with that ?<BR /> Thanks in advance for your help ! </P> Mon, 28 Sep 2015 20:09:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-another-field-with-subsearch/m-p/241845#M71937 clairebesson 2015-09-28T20:09:17Z https://community.splunk.com/t5/Splunk-Search/How-to-display-another-field-with-subsearch/m-p/241846#M71938 <P>Try something like this</P> <PRE><CODE>source="test.csv" earliest=-mon@mo | table Serial "Last Week" | eval From=1 | append [search source="source1.csv" Status="Ship*" | table "Serial Number" OtherFieldThatYourWant | rename "Serial_Number" as Serial | eval From=2 ] | stats values(*) as * by Serial | where mvcount(From)=2 | table Serial "Last Week" OtherFieldThatYourWant </CODE></PRE> Mon, 28 Sep 2015 22:09:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-another-field-with-subsearch/m-p/241846#M71938 somesoni2 2015-09-28T22:09:46Z https://community.splunk.com/t5/Splunk-Search/How-to-display-another-field-with-subsearch/m-p/241847#M71939 <P>Why use join at all? Try this:</P> <PRE><CODE>(source="test.csv") OR (source="source1.csv" "Status"="Ship") | eval Serial=coalesce(Serial, "Serial Number") | stats dc(source) AS numSources values(*) AS * by Serial | where numSources&gt;1 | table Serial "Last Week" OtherFieldThatYourWant </CODE></PRE> Tue, 29 Sep 2015 04:09:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-another-field-with-subsearch/m-p/241847#M71939 woodcock 2015-09-29T04:09:47Z https://community.splunk.com/t5/Splunk-Search/How-to-display-another-field-with-subsearch/m-p/241848#M71940 <P>Thanks a lot ! </P> Tue, 29 Sep 2015 13:01:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-another-field-with-subsearch/m-p/241848#M71940 clairebesson 2015-09-29T13:01:49Z