How can I get the subsearch results in the same row as the main search?

[uhkc777]

Hi,

Please see the image below. I want to get shipcond=NEXTDAY in the first column also. How can I get that? Here, SAP_salesorder is a common field in both.

[sundareshr]

To get it in the same row as the main search, use appendcols instead of append. Note, the column names cannot be same between main search and subsearch.

[uhkc777]

@sundareshr

index=wms-stage 1000075422|search ORDDETAILSTATUS="Shipped"|dedup SAP_SALESORDER SO_LINEITEM|table SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION|appendcols[|search index=sapecc-stage sourcetype="SE8-SalesOrder" 1000075422|table SHIPPINGCONDITION ]|

Output:
SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION
1000075422 10 21 GROUND (FedEx)

Still not getting SHIPPINGCONDITION IN SUBSEARCH as a result

[sundareshr]

Try this

 index=wms-stage 1000075422|search ORDDETAILSTATUS="Shipped"|dedup SAP_SALESORDER SO_LINEITEM|table SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION|appendcols[|search index=sapecc-stage sourcetype="SE8-SalesOrder" 1000075422| rename SHIPPINGCONDITION AS SHIPCOND | table SHIPCOND ]|

[uhkc777]

NO still getting the same result

[sundareshr]

Try this

 index=wms-stage 1000075422|search ORDDETAILSTATUS="Shipped"|dedup SAP_SALESORDER SO_LINEITEM|fields SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION | stats values(*) as * | appendcols[|search index=sapecc-stage sourcetype="SE8-SalesOrder" 1000075422| rename SHIPPINGCONDITION AS SHIPCOND | fields SHIPCOND | stats values(*) as *]|