Hi everyone, I have a question about a subsearch.
I have this query :
source="test.csv" earliest=-mon@mon [search source="source1.csv" "Status"="Ship" | rename "Serial Number" AS "Serial" |table "Serial" ] | table "Serial" "Last Week"
This search displays the serial numbers that are shipped and the date ("Last Week"). I want to display another field which is in "source1".
After having looked at some splunk answers I tried to add "fields" in the subsearch but it didn't work.
Could you please help me with that ?
Thanks in advance for your help !
Try something like this
source="test.csv" earliest=-mon@mo | table Serial "Last Week" | eval From=1 | append [search source="source1.csv" Status="Ship*" | table "Serial Number" OtherFieldThatYourWant | rename "Serial_Number" as Serial | eval From=2 ] | stats values(*) as * by Serial | where mvcount(From)=2 | table Serial "Last Week" OtherFieldThatYourWant
Why use join at all? Try this:
(source="test.csv") OR (source="source1.csv" "Status"="Ship") | eval Serial=coalesce(Serial, "Serial Number") | stats dc(source) AS numSources values(*) AS * by Serial | where numSources>1 | table Serial "Last Week" OtherFieldThatYourWant
Try something like this
source="test.csv" earliest=-mon@mo | table Serial "Last Week" | eval From=1 | append [search source="source1.csv" Status="Ship*" | table "Serial Number" OtherFieldThatYourWant | rename "Serial_Number" as Serial | eval From=2 ] | stats values(*) as * by Serial | where mvcount(From)=2 | table Serial "Last Week" OtherFieldThatYourWant
Thanks a lot !