Splunk Enterprise Security

How do I merge two searches into one, and have all the fields filled in?

ESPrioleau
New Member

I have two seperate searches that I appended together, but I only need one field out of the second search. My problem is the resolts shown on the table are incomplete, some of the fields are "null", when they should be the same as the other rows. Below is my search and the results:

index=windows (SourceName="HP FIRMWARE AUTOMATION PRE-COMPARE" OR SourceName="DELL FIRMWARE AUTOMATION PRE-COMPARE" OR SourceName="HP FIRMWARE AUTOMATION POST-COMPARE" OR SourceName="DELL FIRMWARE AUTOMATION POST-COMPARE") | rex field=hostName "^\w+.(?.)" | rex field=Compliant "^(?.)current\sversion:\s+(?\S+[^a-zA-Z])\s[=|>]\srepository\sversion:\s(?\S+[^a-zA-Z])" | rex field=Message "below (?.)" | eval Compliance=case(Message like "%rebootRequired%", "Compliant") | eval Payload_Staging_Status=case(Compliance="Compliant","Success") | fields hostName, customer, facility, platform, domain, manufacturer, model, Compliance, "Message Code", "Message Description", Payload_Staging_Status, Component, current_version, repository_version | append [ search index=windows (SourceName="HP FIRMWARE AUTOMATION SPP UPDATE FAILURE LOG" OR SourceName="DELL FIRMWARE AUTOMATION UPDATE LOG") | rex field=Message "^(?[^\,]+)" | rex field=ComputerName "^\w+.(?.)" | eval Compliance="Non-Compliant" | eval Payload_Staging_Status="Failure"] | eval fqdn=coalesce(ComputerName,hostName) | search fqdn="XXXX.XXXX.XXXXX" | table _time, fqdn, customer, facility, platform, domain, manufacturer, model, Compliance, "Message Code", "Message Description", Payload_Staging_Status, Message, Component, current_version, repository_version | rename fqdn as "Server Hostname", customer as LOB, facility as Mesh, platform as OS, domain as Domain, manufacturer as Manufacturer, model as Model, Payload_Staging_Status as "Payload Staging Status", Message as "Failure Message", current_version as "Post-Patch Version", repository_version as "Baseline Version"

alt text

the blank fields should be the same as the fields below it

0 Karma

Sukisen1981
Champion

what happens if you just try this after all your code?
|reverse |filldown | reverse

0 Karma

Sukisen1981
Champion

hi @ESPrioleau
Please accept the answer if it significantly helped resolve your issue or let us know if there are any more issues

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...