I have a search that outputs a table like below
user | host | app
-------------------------------------
user1 | host1 | app1
I want to add a new field that that finds the Department of the user from another search. So it would look like this
dep | user | host | app
-------------------------------------
dep1 | user1 | host1 | app1
The second search will have something like this in it so i don't think a join would be sufficient
where match(search,"something\s+user")
Hi @buttsurfer,
in other words: you want to make a join between two searches.
In Splunk there's the "join" command but it must be used only if there isn't any other solution, so you could try this approach:
(index=index1) OR (index=index2)
| stats
values(dep) AS dep
values(host) AS host
values(app) AS app
dc(index) AS index_count
BY user
| where index_count=2
| table dep user host app
Ciao.
Giuseppe
Hi Giuseppe, thanks for the reply. But how would the second search get the value (user) of the first search's result in order to find its department?
Hi @buttsurfer,
in this way you correlate:
using user as correlation key
Ciao.
Giuseppe