Splunk Search

How to append a search and filter by values based off a parent search

splkcurtis
New Member

I have a search for a dashboard and I'd like to filter it based on an IN search with results from parent search.
Is this possible?

| db "SELECT * FROM accounts" | append [| db SELECT * FROM accounts2 | search account_id NOT IN results_account_id]
0 Karma

woodcock
Esteemed Legend

Forget all of your SPL. Show the events in both data sets and a mockup of the desired output.

Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...