After joining 2 tables with just the fields I need, how do I store this new table with the "table" command to use in a different search?

[preetham2677]

I tried to create a search by joining 2 tables and created a new table with just the fields I need. When I tried to view this table in a new search, the fields from just the first table are populated, but not the joined table field values.

[richgalloway · Accepted solution]

It would help to see examples of your data, your existing searches, and what you want in the results.

Keep in mind that Splunk is not SQL. In Splunk, a table is a data display format, not an input.

[preetham2677]

Thanks for the reply.

Sample Query for better understanding the scenario:

source="Table1.csv"

| join type=inner Code[search source="Table2.csv" ]
| eval NewField = "October"
| table Table_new Table1field1, Table2field1, NewField

Is there a way I can store "Table_new" so that I can use it a different query? Or is there a different and efficient way to do it.

Thanks in advance!

[richgalloway]

Have a look at the outputlookup command, which would replace the table command. It stores the query output in a file which a subsequent query can read using inputlookup.

[preetham2677]

Thank you that worked