Splunk Search

Dynamic table - Create three tables in one

renanprado96
Path Finder

Hi, I have three reports, each with a different index.
And I wanted to join them in the same table.
Example:

alt text

I have tables A, B and C.
I wanted to have only one table with four fields: time, K1, K2 and K3.
But, each table is a search for a different index.

Grateful!

0 Karma
1 Solution

gyslainlatsa
Motivator

hi,
try using appendcols (reassures you that the query contains a field that is common to the three indexes)

   index=index1 | your search1
        |appendcols [search index=index2 | your search2] 
        |appendcols [search index=index3 | your search3 ]

see this example with appendcols

index=_internal |stats count as K1 by _time 
|appendcols [search index=_audit |stats count as K2 by _time] 
|appendcols [search index="_introspection" |stats count as K3 by _time ]

that is the result

alt text

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

If your base searches are simple event searches with no pipes, you won't need any append/appendcols or anything that actually joins separate searches. Here is the sort of thing that would achieve this in one search.

(index=A <searchTerms for A> ) OR ( index=B <searchTerms for B> ) OR (index=C <searchTerms for C> )| timechart span=7d avg(K1) avg(K2) avg(K3)

If one or more of your searches actually contain other search commands, and those commands cannot be safely run (or be tweaked to safely run) on the other two searches output rows, that's the sort of use case where you actually do need append/appendcols/join etc.

0 Karma

gyslainlatsa
Motivator

hi,
try using appendcols (reassures you that the query contains a field that is common to the three indexes)

   index=index1 | your search1
        |appendcols [search index=index2 | your search2] 
        |appendcols [search index=index3 | your search3 ]

see this example with appendcols

index=_internal |stats count as K1 by _time 
|appendcols [search index=_audit |stats count as K2 by _time] 
|appendcols [search index="_introspection" |stats count as K3 by _time ]

that is the result

alt text

0 Karma

gyslainlatsa
Motivator

Thanks, don't forget to vote

0 Karma

somesoni2
Revered Legend

Depending upon your current queries for each table, there may be different options, so Please provide your current queries. Possible options for you would be to use appendcols OR join OR append-stats combination OR (recommended way if possible) merge all three query in one base search (others involves sub searches).

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...