Splunk Search

Merge two searches that use two different sourcetypes?

bewald_cfi
New Member

I have two searches from two different sourcetypes. Search #1 is currently in a dashboard with a dropdown selection. I would like to merge both searches into one and still utilize the dropdown selection. Is this possible?

Search #1
sourcetype=Signature host="my_scanner"

| rename extracted_system AS dns
| join dns [ | inputlookup computers.csv Where owner="*"]
| table _time, owner, dns, Risk, Name, CVE, Solution, "See Also"
| rename dns AS Host

Search #2
sourcetype=scans
| rename dest_ip TO dns
| search severity_id>0
| stats count AS plugin_Count BY dns, signature_id, severity_id
| search plugin_Count>1
| lookup computers.csv ip AS dns OUTPUT nt_host AS hostname, owner AS sysadmin
| sort severity_id, sysadmin, hostname
| table sysadmin, hostname, dns, signature_id, severity_id, plugin_Count

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What do you want the combined search to generate as output?

---
If this reply helps you, Karma would be appreciated.
0 Karma

bewald_cfi
New Member

Rich - I would like the results to be: _time, owner, dns, Risk, Name, signature_id, severity_id, plugin_Count, Solution, "See Also". Then from the dashboard the sysadmin can select the owner and sort just on their asset findings.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...