Splunk Search

Dynamic table - Create three tables in one

renanprado96
Path Finder

Hi, I have three reports, each with a different index.
And I wanted to join them in the same table.
Example:

alt text

I have tables A, B and C.
I wanted to have only one table with four fields: time, K1, K2 and K3.
But, each table is a search for a different index.

Grateful!

0 Karma
1 Solution

gyslainlatsa
Motivator

hi,
try using appendcols (reassures you that the query contains a field that is common to the three indexes)

   index=index1 | your search1
        |appendcols [search index=index2 | your search2] 
        |appendcols [search index=index3 | your search3 ]

see this example with appendcols

index=_internal |stats count as K1 by _time 
|appendcols [search index=_audit |stats count as K2 by _time] 
|appendcols [search index="_introspection" |stats count as K3 by _time ]

that is the result

alt text

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

If your base searches are simple event searches with no pipes, you won't need any append/appendcols or anything that actually joins separate searches. Here is the sort of thing that would achieve this in one search.

(index=A <searchTerms for A> ) OR ( index=B <searchTerms for B> ) OR (index=C <searchTerms for C> )| timechart span=7d avg(K1) avg(K2) avg(K3)

If one or more of your searches actually contain other search commands, and those commands cannot be safely run (or be tweaked to safely run) on the other two searches output rows, that's the sort of use case where you actually do need append/appendcols/join etc.

0 Karma

gyslainlatsa
Motivator

hi,
try using appendcols (reassures you that the query contains a field that is common to the three indexes)

   index=index1 | your search1
        |appendcols [search index=index2 | your search2] 
        |appendcols [search index=index3 | your search3 ]

see this example with appendcols

index=_internal |stats count as K1 by _time 
|appendcols [search index=_audit |stats count as K2 by _time] 
|appendcols [search index="_introspection" |stats count as K3 by _time ]

that is the result

alt text

0 Karma

gyslainlatsa
Motivator

Thanks, don't forget to vote

0 Karma

somesoni2
Revered Legend

Depending upon your current queries for each table, there may be different options, so Please provide your current queries. Possible options for you would be to use appendcols OR join OR append-stats combination OR (recommended way if possible) merge all three query in one base search (others involves sub searches).

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...