Splunk Enterprise Security

How do I merge two searches into one, and have all the fields filled in?

New Member

I have two seperate searches that I appended together, but I only need one field out of the second search. My problem is the resolts shown on the table are incomplete, some of the fields are "null", when they should be the same as the other rows. Below is my search and the results:

index=windows (SourceName="HP FIRMWARE AUTOMATION PRE-COMPARE" OR SourceName="DELL FIRMWARE AUTOMATION PRE-COMPARE" OR SourceName="HP FIRMWARE AUTOMATION POST-COMPARE" OR SourceName="DELL FIRMWARE AUTOMATION POST-COMPARE") | rex field=hostName "^\w+.(?.)" | rex field=Compliant "^(?.)current\sversion:\s+(?\S+[^a-zA-Z])\s[=|>]\srepository\sversion:\s(?\S+[^a-zA-Z])" | rex field=Message "below (?.)" | eval Compliance=case(Message like "%rebootRequired%", "Compliant") | eval Payload_Staging_Status=case(Compliance="Compliant","Success") | fields hostName, customer, facility, platform, domain, manufacturer, model, Compliance, "Message Code", "Message Description", Payload_Staging_Status, Component, current_version, repository_version | append [ search index=windows (SourceName="HP FIRMWARE AUTOMATION SPP UPDATE FAILURE LOG" OR SourceName="DELL FIRMWARE AUTOMATION UPDATE LOG") | rex field=Message "^(?[^\,]+)" | rex field=ComputerName "^\w+.(?.)" | eval Compliance="Non-Compliant" | eval Payload_Staging_Status="Failure"] | eval fqdn=coalesce(ComputerName,hostName) | search fqdn="XXXX.XXXX.XXXXX" | table _time, fqdn, customer, facility, platform, domain, manufacturer, model, Compliance, "Message Code", "Message Description", Payload_Staging_Status, Message, Component, current_version, repository_version | rename fqdn as "Server Hostname", customer as LOB, facility as Mesh, platform as OS, domain as Domain, manufacturer as Manufacturer, model as Model, Payload_Staging_Status as "Payload Staging Status", Message as "Failure Message", current_version as "Post-Patch Version", repository_version as "Baseline Version"

alt text

the blank fields should be the same as the fields below it

0 Karma


what happens if you just try this after all your code?
|reverse |filldown | reverse

0 Karma


hi @ESPrioleau
Please accept the answer if it significantly helped resolve your issue or let us know if there are any more issues

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...