Splunk Search

Insert one search into other search as a new column

jyab6z
Path Finder

My code:
My basic search| rex "maingroupNo>(?.+)\(?.+)\(?.+)\"
| convert timeformat="%H:%M:%S" dur2sec(TimeInSec)
| stats count first(TimeInSec) AS endTime last(TimeInSec) AS startTime by UserID DATE maingroup subgroup
| append [search
| My basic search | rex "maingroupNo>(?.+)\(?.+)\(?.+)\"

| stats list(secId) as secId_new by UserID DATE maingroup subgroup ]

The result looks like as following:
alt text

The append command was adding a new table following the result of first search, but I wanna add the second search as a new column of the first search, any ideas?

Thanks in advance!

Tags (1)
0 Karma
1 Solution

jyab6z
Path Finder

Oh, solved my problem 🙂
Used appendcols instead of append.

View solution in original post

jyab6z
Path Finder

Oh, solved my problem 🙂
Used appendcols instead of append.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...