Splunk Search
Highlighted

After joining 2 tables with just the fields I need, how do I store this new table with the "table" command to use in a different search?

Engager

I tried to create a search by joining 2 tables and created a new table with just the fields I need. When I tried to view this table in a new search, the fields from just the first table are populated, but not the joined table field values.

0 Karma
Highlighted

Re: After joining 2 tables with just the fields I need, how do I store this new table with the "table" command to use in a different search?

SplunkTrust
SplunkTrust

It would help to see examples of your data, your existing searches, and what you want in the results.

Keep in mind that Splunk is not SQL. In Splunk, a table is a data display format, not an input.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Highlighted

Re: After joining 2 tables with just the fields I need, how do I store this new table with the "table" command to use in a different search?

Engager

Thanks for the reply.

Sample Query for better understanding the scenario:

source="Table1.csv"

| join type=inner Code[search source="Table2.csv" ]
| eval NewField = "October"
| table Table_new Table1field1, Table2field1, NewField

Is there a way I can store "Table_new" so that I can use it a different query? Or is there a different and efficient way to do it.

Thanks in advance!

0 Karma
Highlighted

Re: After joining 2 tables with just the fields I need, how do I store this new table with the "table" command to use in a different search?

SplunkTrust
SplunkTrust

Have a look at the outputlookup command, which would replace the table command. It stores the query output in a file which a subsequent query can read using inputlookup.

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: After joining 2 tables with just the fields I need, how do I store this new table with the "table" command to use in a different search?

Engager

Thank you that worked

0 Karma