Is there a way to APPEND events based on a field value from main search?

[jedatt01]

I have a use case where a user will input a username and Splunk should return results for that username. But, there are seperate events related that username which do not contain the username field, but instead have the same mac address field. The following command is what I wish would work, but I know the append command doesn't allow you to pass data from the main search.

index=my_index UserName=myuser | table _time UserName MacAddress Message | append MacAddress [search index=my_index | table _time UserName MacAddress Message]

Does anybody know how I can acomplish this?

[chimell]

Hi jedatt01
Try this search code

| set union [search index=my_index UserName=myuser| fields _time MacAddress Message] [search index=my_index NOT UserName| fields  _time MacAddress Message]|table _time MacAddress Message

[somesoni2 · Accepted solution]

So if you want to append result of 2nd search to result of 1st search based on a field (common) from the result of 1st search, you need to use syntax like this. The append function doesn't offer any functionality to append conditionally. You have to use a subsearch in the 2nd search:
Updated

index=my_index UserName=myuser | table _time UserName MacAddress Message 
| append [search index=my_index [search index=my_index UserName=myuser | stats count by MacAddress | table MacAddress ]| table _time UserName MacAddress Message]

[jedatt01]

This worked with one change in the syntax, Remove the MacAddress from after | append

 index=my_index UserName=myuser | table _time UserName MacAddress Message 
 | append [search index=my_index [search index=my_index UserName=myuser | stats count by MacAddress | table MacAddress ]| table _time UserName MacAddress Message]

[somesoni2]

Ohh.. cut copy paste error. Updated the answer.

[somesoni2]

You sample query says both the searches have a field called UserName, Is that a typo?

[s2_splunk]

Have you taken a look at the join command?
Here's a good blog post on event correlation

Hope this helps!

[jedatt01]

From what I understand the join command will join the fields of two events together. What I need to to be able to append the events but the append needs to be based on a common field

[kbecker]

Does the MacAddress field exist in both events? If so "join" would work.