Splunk Search

Can you combine fields from multiple search in one table?

New Member


I'm trying to combine fields in multiple search result in one output table as overall result, for example:

Search 1 result

Search 2 result

Output table

Hope I make the question clear.


0 Karma

New Member


the example of my search are following
search 1

index=devicelogs host=IP address  check_result="*" | table time,user,check_result

result 1


search 2

index=devicelogs host=IP address  client_version="*" | table time,user,client_version

result 2

time, user, client_version

I need to combine the results into one table, which looks like:

0 Karma

Super Champion

can you provide the searches that create those results?

try something like this to create one search:

index=index1 OR index=index2
|eval condition1=if(index="index1",condition,null())
|eval condition2=if(index="index2",condition,null())
|stats values(condition1) as condition1 values(condition2) as condtion2 by time username

or you can use join type=left username time with the two searches. however, there are limits with join.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...