Splunk Search

How to construct a search that combines two different searches with no common fields?

pavanae
Builder

I'd joined two different searches and trying to display the search 2 table for search 1 users. Both the searches have the usernames field different

search 1 displays usernames with field name "usernumber"
search 2 displays usernames with field name "userid"

I know if both the searches has same field name i can display as below

search 1 | fields userid | join userid [search 2]

But here the scenario is different. Even though the field names are different, how can i combine those two searches?

0 Karma
1 Solution

sundareshr
Legend

Try this

(base search for search 1) OR (base search for search 2) | eval user=coalesce(usernumber, userid) | stats values(*) as * by user

*OR* if you must user join (not recommeded), just rename the field in the sub-search

search 1 | fields userid | join userid [search | fields | usernumber | rename usernumber AS userid] | ...

View solution in original post

0 Karma

sundareshr
Legend

Try this

(base search for search 1) OR (base search for search 2) | eval user=coalesce(usernumber, userid) | stats values(*) as * by user

*OR* if you must user join (not recommeded), just rename the field in the sub-search

search 1 | fields userid | join userid [search | fields | usernumber | rename usernumber AS userid] | ...
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...