Splunk Search

Dynamic table - Create three tables in one

renanprado96
Path Finder

Hi, I have three reports, each with a different index.
And I wanted to join them in the same table.
Example:

alt text

I have tables A, B and C.
I wanted to have only one table with four fields: time, K1, K2 and K3.
But, each table is a search for a different index.

Grateful!

0 Karma
1 Solution

gyslainlatsa
Motivator

hi,
try using appendcols (reassures you that the query contains a field that is common to the three indexes)

   index=index1 | your search1
        |appendcols [search index=index2 | your search2] 
        |appendcols [search index=index3 | your search3 ]

see this example with appendcols

index=_internal |stats count as K1 by _time 
|appendcols [search index=_audit |stats count as K2 by _time] 
|appendcols [search index="_introspection" |stats count as K3 by _time ]

that is the result

alt text

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

If your base searches are simple event searches with no pipes, you won't need any append/appendcols or anything that actually joins separate searches. Here is the sort of thing that would achieve this in one search.

(index=A <searchTerms for A> ) OR ( index=B <searchTerms for B> ) OR (index=C <searchTerms for C> )| timechart span=7d avg(K1) avg(K2) avg(K3)

If one or more of your searches actually contain other search commands, and those commands cannot be safely run (or be tweaked to safely run) on the other two searches output rows, that's the sort of use case where you actually do need append/appendcols/join etc.

0 Karma

gyslainlatsa
Motivator

hi,
try using appendcols (reassures you that the query contains a field that is common to the three indexes)

   index=index1 | your search1
        |appendcols [search index=index2 | your search2] 
        |appendcols [search index=index3 | your search3 ]

see this example with appendcols

index=_internal |stats count as K1 by _time 
|appendcols [search index=_audit |stats count as K2 by _time] 
|appendcols [search index="_introspection" |stats count as K3 by _time ]

that is the result

alt text

0 Karma

gyslainlatsa
Motivator

Thanks, don't forget to vote

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Depending upon your current queries for each table, there may be different options, so Please provide your current queries. Possible options for you would be to use appendcols OR join OR append-stats combination OR (recommended way if possible) merge all three query in one base search (others involves sub searches).

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...