https://community.splunk.com/t5/Splunk-Search/How-to-join-search-results-without-using-join-command/m-p/253444#M75832 <P>That's <A href="http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Append">append</A> that you want. It just takes one set of results and adds another set of results to it, like pasting new rows at the end of a spreadsheet or something.</P> <PRE><CODE>search that returns the Field1-4 rows | append [search search that returns the FieldA-C rows ] </CODE></PRE> <P>There's lot of good examples in the docs I linked above. I suggest reviewing those closely to learn how it handles certain things.</P> Fri, 02 Dec 2016 12:34:43 GMT Richfez 2016-12-02T12:34:43Z https://community.splunk.com/t5/Splunk-Search/How-to-join-search-results-without-using-join-command/m-p/253443#M75831 <P>I have this situation:</P> <PRE><CODE>Table1 Id Field1 Field2 Field3 Table2 Id FieldA FieldB </CODE></PRE> <P>I need this result:</P> <PRE><CODE>Id Field1 Field2 Field3 FieldA FieldB </CODE></PRE> <P>Ok... that's easy, right?<BR /> But I can't use "join" clause and subsearch.</P> <P>I've tried transaction and others options, but the result is wrong.</P> <P>Can somebody help me? </P> Fri, 02 Dec 2016 11:03:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-search-results-without-using-join-command/m-p/253443#M75831 usersplunktest 2016-12-02T11:03:08Z https://community.splunk.com/t5/Splunk-Search/How-to-join-search-results-without-using-join-command/m-p/253444#M75832 <P>That's <A href="http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Append">append</A> that you want. It just takes one set of results and adds another set of results to it, like pasting new rows at the end of a spreadsheet or something.</P> <PRE><CODE>search that returns the Field1-4 rows | append [search search that returns the FieldA-C rows ] </CODE></PRE> <P>There's lot of good examples in the docs I linked above. I suggest reviewing those closely to learn how it handles certain things.</P> Fri, 02 Dec 2016 12:34:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-search-results-without-using-join-command/m-p/253444#M75832 Richfez 2016-12-02T12:34:43Z https://community.splunk.com/t5/Splunk-Search/How-to-join-search-results-without-using-join-command/m-p/253445#M75833 <P>As I think on this, you may not even need append. You might be able to get by with just using <CODE>OR</CODE> between the two things you are searching for. Like...</P> <PRE><CODE>source=Table1 OR source=Table2 </CODE></PRE> <P>And, if you want it sorted like in your example,</P> <PRE><CODE>source=Table1 OR source=Table2 | sort Id </CODE></PRE> <P>Splunk normally puts <CODE>AND</CODE> between terms, using <CODE>OR</CODE> just ... well, makes it OR.</P> <P>Happy Splunking!<BR /> -Rich</P> Fri, 02 Dec 2016 17:37:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-search-results-without-using-join-command/m-p/253445#M75833 Richfez 2016-12-02T17:37:55Z