Splunk Search

How can I get the subsearch results in the same row as the main search?

Explorer

Hi,

Please see the image below. I want to get shipcond=NEXTDAY in the first column also. How can I get that? Here, SAP_salesorder is a common field in both.
alt text

0 Karma

Legend

To get it in the same row as the main search, use appendcols instead of append. Note, the column names cannot be same between main search and subsearch.

0 Karma

Explorer

@sundareshr

index=wms-stage 1000075422|search ORDDETAILSTATUS="Shipped"|dedup SAP_SALESORDER SO_LINEITEM|table SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION|appendcols[|search index=sapecc-stage sourcetype="SE8-SalesOrder" 1000075422|table SHIPPINGCONDITION ]|

Output:
SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION
1000075422 10 21 GROUND (FedEx)

Still not getting SHIPPINGCONDITION IN SUBSEARCH as a result

0 Karma

Legend

Try this

 index=wms-stage 1000075422|search ORDDETAILSTATUS="Shipped"|dedup SAP_SALESORDER SO_LINEITEM|table SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION|appendcols[|search index=sapecc-stage sourcetype="SE8-SalesOrder" 1000075422| rename SHIPPINGCONDITION AS SHIPCOND | table SHIPCOND ]|
0 Karma

Explorer

NO still getting the same result

0 Karma

Legend

Try this

 index=wms-stage 1000075422|search ORDDETAILSTATUS="Shipped"|dedup SAP_SALESORDER SO_LINEITEM|fields SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION | stats values(*) as * | appendcols[|search index=sapecc-stage sourcetype="SE8-SalesOrder" 1000075422| rename SHIPPINGCONDITION AS SHIPCOND | fields SHIPCOND | stats values(*) as *]|
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!