How to create new field with values from a search that uses values of current field?

[buttsurfer]

I have a search that outputs a table like below

         user  |  host  |  app
-------------------------------------

        user1 | host1 | app1

I want to add a new field that that finds the Department of the user from another search. So it would look like this 

     dep  |  user  |  host  |  app
-------------------------------------

    dep1 |  user1 | host1 | app1

The second search will have something like this in it so i don't think a join would be sufficient 

where match(search,"something\s+user")

[gcusello]

Hi @buttsurfer,

in other words: you want to make a join between two searches.

In Splunk there's the "join" command but it must be used only if there isn't any other solution, so you could try this approach:

(index=index1) OR (index=index2)
| stats 
   values(dep) AS dep 
   values(host) AS host 
   values(app) AS app 
   dc(index) AS index_count
   BY user
| where index_count=2
| table dep user host app

Ciao.

Giuseppe

[buttsurfer]

Hi Giuseppe, thanks for the reply. But how would the second search get the value (user) of the first search's result in order to find its department?

[gcusello]

Hi @buttsurfer,

in this way you correlate:

• user,  host and  app from the first search
• dep and user from the second search

using user as correlation key

Ciao.

Giuseppe