Combine the two search commands output to get the desired result

[harshal_chakran]

Hi,

I have one search command which gives the output in table as shown below:

parameter1 value1

param1 10

param2 20

param3 30

param4 40

param5 50

And other serach which gives the output as:-

parameter2 value2

param7 10

param10 20

param1 30

param2 40

param4 50

param17 60

param5 70

param20 80

param3 90

param8 100

I want the output as :-

parameter value1 value2

param1 10 30

param2 20 40

param3 30 90

param4 40 50

param5 50 70

I am trying to implement one search command by appending both the searches to get the provided result. Only first command parameters should taken from second command to form the final result.

Please Help...!!!

[jpass]

please share the searches you use to generate the two different sets of output.

[somesoni2 · Accepted solution]

I guess you can try join command as follows

<your first search giving parameter1, value1> | rename parameter1 as parameter
| join parameter [search <your second search giving parameter2 and value2> | rename parameter2 as parameter] | table parameter, value1, value2

Other option you can try is appendcols but it has come limitations

[Rocket66]

It's difficult to find a solution without knowing the searches 🙂

But some approach is to combine the 2 searches with "OR" and then pipe the result and make a "stats count" on that values "by parameter" ... and then do a "mvexpand" on that multivalues.

But this is a very rough approach 🙂

Greetz, Robert