Splunk Search

How to display another field with subsearch ?

clairebesson
Explorer

Hi everyone, I have a question about a subsearch.
I have this query :

source="test.csv" earliest=-mon@mon [search source="source1.csv" "Status"="Ship" | rename "Serial Number" AS "Serial" |table "Serial" ] | table "Serial" "Last Week"

This search displays the serial numbers that are shipped and the date ("Last Week"). I want to display another field which is in "source1".
After having looked at some splunk answers I tried to add "fields" in the subsearch but it didn't work.

Could you please help me with that ?
Thanks in advance for your help !

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

source="test.csv" earliest=-mon@mo  | table Serial "Last Week" | eval From=1 | append [search source="source1.csv" Status="Ship*" | table "Serial Number" OtherFieldThatYourWant | rename "Serial_Number" as Serial | eval From=2 ] | stats values(*) as * by Serial | where mvcount(From)=2 | table Serial "Last Week" OtherFieldThatYourWant 

View solution in original post

0 Karma

woodcock
Esteemed Legend

Why use join at all? Try this:

(source="test.csv") OR (source="source1.csv" "Status"="Ship") | eval Serial=coalesce(Serial, "Serial Number") | stats dc(source) AS numSources values(*) AS * by Serial | where numSources>1 | table Serial "Last Week" OtherFieldThatYourWant
0 Karma

somesoni2
Revered Legend

Try something like this

source="test.csv" earliest=-mon@mo  | table Serial "Last Week" | eval From=1 | append [search source="source1.csv" Status="Ship*" | table "Serial Number" OtherFieldThatYourWant | rename "Serial_Number" as Serial | eval From=2 ] | stats values(*) as * by Serial | where mvcount(From)=2 | table Serial "Last Week" OtherFieldThatYourWant 
0 Karma

clairebesson
Explorer

Thanks a lot !

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...