https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-and-display-as-a-single-table/m-p/282788#M85416 <PRE><CODE>My search |top 5 users|join users [search My search |stats values(field_1) as field_1 values(field_2) as field_2 by users] </CODE></PRE> <P>it probably isn't the most efficient way but it should work.</P> Thu, 27 Oct 2016 13:27:56 GMT cmerriman 2016-10-27T13:27:56Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-and-display-as-a-single-table/m-p/282787#M85415 <P>I have the below search_1 </P> <PRE><CODE>My search |top 5 users </CODE></PRE> <P>I have a second search as below</P> <PRE><CODE>My search |stats values(field_1) as field_1 values(field_2) as field_2 by users </CODE></PRE> <P>Now how can I combine these two searches and display a result in tabular chart which contains field_1 and field_2 values of the top 5 users only?</P> Tue, 29 Sep 2020 11:36:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-and-display-as-a-single-table/m-p/282787#M85415 pavanae 2020-09-29T11:36:47Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-and-display-as-a-single-table/m-p/282788#M85416 <PRE><CODE>My search |top 5 users|join users [search My search |stats values(field_1) as field_1 values(field_2) as field_2 by users] </CODE></PRE> <P>it probably isn't the most efficient way but it should work.</P> Thu, 27 Oct 2016 13:27:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-and-display-as-a-single-table/m-p/282788#M85416 cmerriman 2016-10-27T13:27:56Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-and-display-as-a-single-table/m-p/282789#M85417 <P>Why not just calculate the top users in your stats command by adding a count since that is what top is doing and then only grab the top 5 from the stats results after you sort it ?</P> <PRE><CODE>... |stats values(field_1) as field_1 values(field_2) as field_2 count by users | sort - count | head 5 </CODE></PRE> Thu, 27 Oct 2016 13:41:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-and-display-as-a-single-table/m-p/282789#M85417 MattZerfas 2016-10-27T13:41:00Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-and-display-as-a-single-table/m-p/282790#M85418 <P>Use a sub search to collect the top 5 users:</P> <PRE><CODE>[search My search | top 5 users | fields users] My search | stats values(field_1) as field_1 values(field_2) as field_2 by users </CODE></PRE> <P>The results from that sub search are OR'd together, something like this:</P> <PRE><CODE>(users=ABC OR users=DEF OR users=GHI OR users=JKL OR users=MNO) My search ... </CODE></PRE> Thu, 27 Oct 2016 13:54:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-and-display-as-a-single-table/m-p/282790#M85418 twinspop 2016-10-27T13:54:31Z