topic Re: How to combine two searches so that I can get only those rows from Search2 whose Col-1 value is present in Search1 Col-1? in Splunk Search

How to combine two searches so that I can get only those rows from Search2 whose Col-1 value is present in Search1 Col-1?

anil_kr01 — Tue, 10 May 2016 09:13:08 GMT

I have a serach which will gives the Top 4 records.

Example

Search1 result looks like

Col-1

ABC
DEF
GHI
JKL

I have one another search which gives the result like:

Search2 result looks like:

Col-1 Col-2

ABC 123
DEF 456
GHI 789
ABC 101
JKL 112
MNO 131
PQR 415
STU 161
VWX 718

How can I get the below result using the 2 searches above (Only those rows from Search2 whose Col-1 value is present in Search1 Col-1)?

Expected Final Result Table

Col-1 Col-2

ABC 123
DEF 456
GHI 789
ABC 101
JKL 112

Please guide/help me.

ctaf — Tue, 10 May 2016 09:52:46 GMT

Hello,

Have you tried :

Query 2 [ Query 1 ]

anil_kr01 — Tue, 10 May 2016 13:56:58 GMT

I have tried that but it doesn't work 😞

ctaf — Tue, 10 May 2016 14:08:58 GMT

Is the field name of Col-1 is the same in both queries?

anil_kr01 — Wed, 11 May 2016 04:48:32 GMT

Yes! it is same in both the query.

anil_kr01 — Wed, 11 May 2016 11:07:59 GMT

I downvoted this post because the suggested way is not working....

sundareshr — Wed, 11 May 2016 12:00:54 GMT

Try this...

source=A OR source=B | eventstats dc(source) as x by col1 | where x=1 AND source=B | table col1 col2

bainskaransingh — Wed, 11 May 2016 12:03:41 GMT

You can try this:

search2 | table Col1, col2| join Col1 [search search1| table Col1]

Please let me know if this doesn't work and mark as answered if it works