Splunk Search

Combine the two search commands output to get the desired result

Hi,

I have one search command which gives the output in table as shown below:

parameter1 value1

param1 10

param2 20

param3 30

param4 40

param5 50

And other serach which gives the output as:-

parameter2 value2

param7 10

param10 20

param1 30

param2 40

param4 50

param17 60

param5 70

param20 80

param3 90

param8 100

I want the output as :-

parameter value1 value2

param1 10 30

param2 20 40

param3 30 90

param4 40 50

param5 50 70

I am trying to implement one search command by appending both the searches to get the provided result. Only first command parameters should taken from second command to form the final result.

Please Help...!!!

Tags (4)
0 Karma
1 Solution

Revered Legend

I guess you can try join command as follows

<your first search giving parameter1, value1> | rename parameter1 as parameter
| join parameter [search <your second search giving parameter2 and value2> | rename parameter2 as parameter] | table parameter, value1, value2

Other option you can try is appendcols but it has come limitations

View solution in original post

Contributor

please share the searches you use to generate the two different sets of output.

0 Karma

Revered Legend

I guess you can try join command as follows

<your first search giving parameter1, value1> | rename parameter1 as parameter
| join parameter [search <your second search giving parameter2 and value2> | rename parameter2 as parameter] | table parameter, value1, value2

Other option you can try is appendcols but it has come limitations

View solution in original post

Communicator

It's difficult to find a solution without knowing the searches 🙂

But some approach is to combine the 2 searches with "OR" and then pipe the result and make a "stats count" on that values "by parameter" ... and then do a "mvexpand" on that multivalues.

But this is a very rough approach 🙂

Greetz, Robert

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!