Splunk Search

Insert one search into other search as a new column

jyab6z
Path Finder

My code:
My basic search| rex "maingroupNo>(?.+)\(?.+)\(?.+)\"
| convert timeformat="%H:%M:%S" dur2sec(TimeInSec)
| stats count first(TimeInSec) AS endTime last(TimeInSec) AS startTime by UserID DATE maingroup subgroup
| append [search
| My basic search | rex "maingroupNo>(?.+)\(?.+)\(?.+)\"

| stats list(secId) as secId_new by UserID DATE maingroup subgroup ]

The result looks like as following:
alt text

The append command was adding a new table following the result of first search, but I wanna add the second search as a new column of the first search, any ideas?

Thanks in advance!

Tags (1)
0 Karma
1 Solution

jyab6z
Path Finder

Oh, solved my problem 🙂
Used appendcols instead of append.

View solution in original post

jyab6z
Path Finder

Oh, solved my problem 🙂
Used appendcols instead of append.

Get Updates on the Splunk Community!

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...