how to add a column

[Keerthi]

Hi , needed a help. i need to add a column that is added newly to the sql data.below is the query
| savedsearch ABC
| join type=left BS_ID [| search index="PQR" source=XYZ
| rename BS_CODE as BS_ID SERVICE_OWNER as "System Owner" BUSINESS_OWNER as "Business Owner" SERVICE_SUBCATEGORY as Function SDM_FULLNAME as SDM
| sort LOGICAL_NAME | eval Application = DESCRIPTION
| rex mode=sed field=Application "s/^Managed//g" | rex mode=sed field=Application "s/Application$//g" | rex mode=sed field=Application "s/application$//g"
| eval Application = trim(Application)
| streamstats count as NO by BS_ID
| eventstats max(NO) as MaxTotal by BS_ID
| where NO=MaxTotal
|eval Function=case(Function="Service Excellence COE" and Application="Medical Insights Reporting","Service Excellence CoE",1=1,Function)
| table BS_ID Application Function SDM "System Owner" "Business Owner"]
| lookup countries.csv name as COUNTRY outputnew latitude, longitude, name
| eval COUNTRY = if(isnull(COUNTRY),"NA",COUNTRY)
| eval DEPARTMENT_LONG_NAME = if(isnull(DEPARTMENT_LONG_NAME),"NA",DEPARTMENT_LONG_NAME)
| eval DEPARTMENT_SHORT_NAME = if(isnull(DEPARTMENT_SHORT_NAME),"NA",DEPARTMENT_SHORT_NAME)

my ABC savedsearch has a column newly added as Category. i need to get into this saved search

[isoutamo]

Hi

Based on your query, it should be there (just "correctly" formatted,  You get this by press Ctrl/Cmd+F)

| savedsearch ABC 
| join type=left BS_ID 
    [| search index="PQR" source=XYZ 
    | rename BS_CODE as BS_ID SERVICE_OWNER as "System Owner" BUSINESS_OWNER as "Business Owner" SERVICE_SUBCATEGORY as Function SDM_FULLNAME as SDM 
    | sort LOGICAL_NAME 
    | eval Application = DESCRIPTION 
    | rex mode=sed field=Application "s/^Managed//g" 
    | rex mode=sed field=Application "s/Application$//g" 
    | rex mode=sed field=Application "s/application$//g" 
    | eval Application = trim(Application) 
    | streamstats count as NO by BS_ID 
    | eventstats max(NO) as MaxTotal by BS_ID 
    | where NO=MaxTotal 
    | eval Function=case(Function="Service Excellence COE" and Application="Medical Insights Reporting","Service Excellence CoE",1=1,Function) 
    | table BS_ID Application Function SDM "System Owner" "Business Owner"] 
| lookup countries.csv name as COUNTRY outputnew latitude, longitude, name 
| eval COUNTRY = if(isnull(COUNTRY),"NA",COUNTRY) 
| eval DEPARTMENT_LONG_NAME = if(isnull(DEPARTMENT_LONG_NAME),"NA",DEPARTMENT_LONG_NAME) 
| eval DEPARTMENT_SHORT_NAME = if(isnull(DEPARTMENT_SHORT_NAME),"NA",DEPARTMENT_SHORT_NAME)

Are you sure that your

| savedsearch ABC 

 return that field, when you are running it that way?

r. Ismo