How to display another field with subsearch ?

[clairebesson]

Hi everyone, I have a question about a subsearch.
I have this query :

source="test.csv" earliest=-mon@mon [search source="source1.csv" "Status"="Ship" | rename "Serial Number" AS "Serial" |table "Serial" ] | table "Serial" "Last Week"

This search displays the serial numbers that are shipped and the date ("Last Week"). I want to display another field which is in "source1".
After having looked at some splunk answers I tried to add "fields" in the subsearch but it didn't work.

Could you please help me with that ?
Thanks in advance for your help !

[woodcock]

Why use join at all? Try this:

(source="test.csv") OR (source="source1.csv" "Status"="Ship") | eval Serial=coalesce(Serial, "Serial Number") | stats dc(source) AS numSources values(*) AS * by Serial | where numSources>1 | table Serial "Last Week" OtherFieldThatYourWant

[somesoni2 · Accepted solution]

Try something like this

source="test.csv" earliest=-mon@mo  | table Serial "Last Week" | eval From=1 | append [search source="source1.csv" Status="Ship*" | table "Serial Number" OtherFieldThatYourWant | rename "Serial_Number" as Serial | eval From=2 ] | stats values(*) as * by Serial | where mvcount(From)=2 | table Serial "Last Week" OtherFieldThatYourWant 

[clairebesson]

Thanks a lot !