Hi,
Please see the image below. I want to get shipcond=NEXTDAY in the first column also. How can I get that? Here, SAP_salesorder is a common field in both.
To get it in the same row as the main search, use appendcols
instead of append
. Note, the column names cannot be same between main search and subsearch.
index=wms-stage 1000075422|search ORDDETAILSTATUS="Shipped"|dedup SAP_SALESORDER SO_LINEITEM|table SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION|appendcols[|search index=sapecc-stage sourcetype="SE8-SalesOrder" 1000075422|table SHIPPINGCONDITION ]|
Output:
SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION
1000075422 10 21 GROUND (FedEx)
Still not getting SHIPPINGCONDITION IN SUBSEARCH as a result
Try this
index=wms-stage 1000075422|search ORDDETAILSTATUS="Shipped"|dedup SAP_SALESORDER SO_LINEITEM|table SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION|appendcols[|search index=sapecc-stage sourcetype="SE8-SalesOrder" 1000075422| rename SHIPPINGCONDITION AS SHIPCOND | table SHIPCOND ]|
NO still getting the same result
Try this
index=wms-stage 1000075422|search ORDDETAILSTATUS="Shipped"|dedup SAP_SALESORDER SO_LINEITEM|fields SAP_SALESORDER SO_LINEITEM SHIPPINGCODE SHIPCONDITION | stats values(*) as * | appendcols[|search index=sapecc-stage sourcetype="SE8-SalesOrder" 1000075422| rename SHIPPINGCONDITION AS SHIPCOND | fields SHIPCOND | stats values(*) as *]|