Splunk Search

Insert one search into other search as a new column

jyab6z
Path Finder

My code:
My basic search| rex "maingroupNo>(?.+)\(?.+)\(?.+)\"
| convert timeformat="%H:%M:%S" dur2sec(TimeInSec)
| stats count first(TimeInSec) AS endTime last(TimeInSec) AS startTime by UserID DATE maingroup subgroup
| append [search
| My basic search | rex "maingroupNo>(?.+)\(?.+)\(?.+)\"

| stats list(secId) as secId_new by UserID DATE maingroup subgroup ]

The result looks like as following:
alt text

The append command was adding a new table following the result of first search, but I wanna add the second search as a new column of the first search, any ideas?

Thanks in advance!

Tags (1)
0 Karma
1 Solution

jyab6z
Path Finder

Oh, solved my problem 🙂
Used appendcols instead of append.

View solution in original post

jyab6z
Path Finder

Oh, solved my problem 🙂
Used appendcols instead of append.

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...