run new search based on row-value and get the results in a new column

[gpincheiraa]

I have the following table of results

|trkid | values |
|123 | a |
|124 | b |
|125 | d |

But i need based on the trkid row-value, run a new search and show the results in a new column and get the following

|trkid | values | new_col |
|123 | a | 1 | ----> this value is the result of using the trkid value in another search. Example: [search trkid=123 | stats count as new_col]
|124 | b | 1 | ----> this value is the result of using the trkid value in another search. Example: [search trkid=124 | stats count as new_col]
|125 | d | 3 |----> this value is the result of using the trkid value in another search. Example: [search trkid=125 | stats count as new_col]

It is possible?

[somesoni2]

Try like this

index=foo [search index=foo...your current search giving results with field trkid and values | stats count by trkid | table trkid] | stats count as new_col by trkid
| append [search index=foo...your current search giving results with field trkid and values ]
| stats values(values) as values(new_col) as new_col by trkid

Can provide better representation if we have your current full query (and other query that you want to run based on trkid).

[cmerriman · Accepted solution]

you're wanting to add a new column to the end of your existing results based on the results you already have?

i would try to first just go with:

basesearch...|eventstats count by trkid

but you can also use appendpipe if you're trying to limit which trkid value to count:

basesearch...|appendpipe [search trkid=125 | stats count as new_col]

[DalJeanis]

And, if you want to add the results of different searches to your results, then there are more options.

Append -

(your existing search) 
| table trkid myvalues
| append [index=foo your new search | stats count as new_col by trkid]
| stats values(*) as * by trkid
| table trkid myvalues new_col

Join -

(your existing search) 
| table trkid myvalues
| join type=left trkid [index=foo your new search | stats count as new_col by trkid]
| fillnull value=0 new_col
| table trkid myvalues new_col

Map -

(your existing search) 
| table trkid myvalues
| map search="search index=foo trkid2=$trkid$ | your calculations | eval myvalues=\"$myvalues$\""
| table trkid myvalues new_col

MANY more options...