topic Re: How can I get the subsearch results in the same row as the main search? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-can-I-get-the-subsearch-results-in-the-same-row-as-the-main/m-p/272045#M81862 <P>Try this</P> <PRE><CODE> index=wms-stage 1000075422|search ORDDETAILSTATUS="Shipped"|dedup SAP_SALESORDER SO_LINEITEM|fields SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION | stats values(*) as * | appendcols[|search index=sapecc-stage sourcetype="SE8-SalesOrder" 1000075422| rename SHIPPINGCONDITION AS SHIPCOND | fields SHIPCOND | stats values(*) as *]| </CODE></PRE> Fri, 09 Sep 2016 21:05:49 GMT sundareshr 2016-09-09T21:05:49Z How can I get the subsearch results in the same row as the main search? https://community.splunk.com/t5/Splunk-Search/How-can-I-get-the-subsearch-results-in-the-same-row-as-the-main/m-p/272040#M81857 <P>Hi,</P> <P>Please see the image below. I want to get shipcond=NEXTDAY in the first column also. How can I get that? Here, SAP_salesorder is a common field in both. <BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1822i64E47994EDD75920/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 09 Sep 2016 20:20:57 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-the-subsearch-results-in-the-same-row-as-the-main/m-p/272040#M81857 uhkc777 2016-09-09T20:20:57Z Re: How can I get the subsearch results in the same row as the main search? https://community.splunk.com/t5/Splunk-Search/How-can-I-get-the-subsearch-results-in-the-same-row-as-the-main/m-p/272041#M81858 <P>To get it in the same row as the main search, use <CODE>appendcols</CODE> instead of <CODE>append</CODE>. Note, the column names cannot be same between main search and subsearch.</P> Fri, 09 Sep 2016 20:28:00 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-the-subsearch-results-in-the-same-row-as-the-main/m-p/272041#M81858 sundareshr 2016-09-09T20:28:00Z Re: How can I get the subsearch results in the same row as the main search? https://community.splunk.com/t5/Splunk-Search/How-can-I-get-the-subsearch-results-in-the-same-row-as-the-main/m-p/272042#M81859 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/140181">@sundareshr</a></P> <PRE><CODE>index=wms-stage 1000075422|search ORDDETAILSTATUS="Shipped"|dedup SAP_SALESORDER SO_LINEITEM|table SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION|appendcols[|search index=sapecc-stage sourcetype="SE8-SalesOrder" 1000075422|table SHIPPINGCONDITION ]| </CODE></PRE> <P>Output: <BR /> SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION<BR /> 1000075422 10 21 GROUND (FedEx)</P> <P>Still not getting SHIPPINGCONDITION IN SUBSEARCH as a result</P> Tue, 29 Sep 2020 10:55:06 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-the-subsearch-results-in-the-same-row-as-the-main/m-p/272042#M81859 uhkc777 2020-09-29T10:55:06Z Re: How can I get the subsearch results in the same row as the main search? https://community.splunk.com/t5/Splunk-Search/How-can-I-get-the-subsearch-results-in-the-same-row-as-the-main/m-p/272043#M81860 <P>Try this</P> <PRE><CODE> index=wms-stage 1000075422|search ORDDETAILSTATUS="Shipped"|dedup SAP_SALESORDER SO_LINEITEM|table SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION|appendcols[|search index=sapecc-stage sourcetype="SE8-SalesOrder" 1000075422| rename SHIPPINGCONDITION AS SHIPCOND | table SHIPCOND ]| </CODE></PRE> Fri, 09 Sep 2016 20:46:35 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-the-subsearch-results-in-the-same-row-as-the-main/m-p/272043#M81860 sundareshr 2016-09-09T20:46:35Z Re: How can I get the subsearch results in the same row as the main search? https://community.splunk.com/t5/Splunk-Search/How-can-I-get-the-subsearch-results-in-the-same-row-as-the-main/m-p/272044#M81861 <P>NO still getting the same result</P> Fri, 09 Sep 2016 20:52:16 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-the-subsearch-results-in-the-same-row-as-the-main/m-p/272044#M81861 uhkc777 2016-09-09T20:52:16Z Re: How can I get the subsearch results in the same row as the main search? https://community.splunk.com/t5/Splunk-Search/How-can-I-get-the-subsearch-results-in-the-same-row-as-the-main/m-p/272045#M81862 <P>Try this</P> <PRE><CODE> index=wms-stage 1000075422|search ORDDETAILSTATUS="Shipped"|dedup SAP_SALESORDER SO_LINEITEM|fields SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION | stats values(*) as * | appendcols[|search index=sapecc-stage sourcetype="SE8-SalesOrder" 1000075422| rename SHIPPINGCONDITION AS SHIPCOND | fields SHIPCOND | stats values(*) as *]| </CODE></PRE> Fri, 09 Sep 2016 21:05:49 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-the-subsearch-results-in-the-same-row-as-the-main/m-p/272045#M81862 sundareshr 2016-09-09T21:05:49Z