Splunk Search

Can you combine fields from multiple search in one table?

Engager

Hi

I'm trying to combine fields in multiple search result in one output table as overall result, for example:

Search 1 result
Date,open ,close

Search 2 result
incident ,type1,result

Output table
Date,open ,close,incident ,type1,result

Hope question is clear

Thanks

0 Karma

Builder

Hi @roopasree

There should be a common field in main & sub search to map the results correctly,

if you want to just append the columns use the above answer ----- appendcols, append commands should work for that.

if you want to map the results between main and sub search based on a specific field ----- join command should work for you.

main search | fields date,open,close,incidentnum | join incidentnum [search subsearch | fields incident,type1,result,incidentnum] | stats c by date,open,close,incidentnum,incident,type1,result

Thanks

Path Finder

Sure, just use | appendcols

search foo | fields date,open,close | appendcols [ search bar | fields incident,type1,result]

http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Appendcols

0 Karma

Influencer

How will you know what rows from result 1 relate to what rows in result 2? Is there not a common field between the two datasets?

0 Karma

Engager

@gpradeepkumarreddy yes there is no comman field among two datasets

0 Karma