topic Re: Dynamic table - Create three tables in one in Splunk Search

Dynamic table - Create three tables in one

renanprado96 — Thu, 10 Mar 2016 19:03:08 GMT

Hi, I have three reports, each with a different index.
And I wanted to join them in the same table.
Example:

I have tables A, B and C.
I wanted to have only one table with four fields: time, K1, K2 and K3.
But, each table is a search for a different index.

Grateful!

Re: Dynamic table - Create three tables in one

somesoni2 — Thu, 10 Mar 2016 19:36:16 GMT

Depending upon your current queries for each table, there may be different options, so Please provide your current queries. Possible options for you would be to use appendcols OR join OR append-stats combination OR (recommended way if possible) merge all three query in one base search (others involves sub searches).

Re: Dynamic table - Create three tables in one

gyslainlatsa — Thu, 10 Mar 2016 20:08:22 GMT

hi,
try using appendcols (reassures you that the query contains a field that is common to the three indexes)

   index=index1 | your search1
        |appendcols [search index=index2 | your search2] 
        |appendcols [search index=index3 | your search3 ]

see this example with appendcols

index=_internal |stats count as K1 by _time 
|appendcols [search index=_audit |stats count as K2 by _time] 
|appendcols [search index="_introspection" |stats count as K3 by _time ]

that is the result

Re: Dynamic table - Create three tables in one

sideview — Thu, 10 Mar 2016 20:28:42 GMT

If your base searches are simple event searches with no pipes, you won't need any append/appendcols or anything that actually joins separate searches. Here is the sort of thing that would achieve this in one search.

(index=A <searchTerms for A> ) OR ( index=B <searchTerms for B> ) OR (index=C <searchTerms for C> )| timechart span=7d avg(K1) avg(K2) avg(K3)

If one or more of your searches actually contain other search commands, and those commands cannot be safely run (or be tweaked to safely run) on the other two searches output rows, that's the sort of use case where you actually do need append/appendcols/join etc.

Re: Dynamic table - Create three tables in one

gyslainlatsa — Sat, 12 Mar 2016 17:54:23 GMT

Thanks, don't forget to vote