splunk subsearch query help

[surekhasplunk]

Hi,

I have a main query which returns below 4 columns:

rule, result, name, department

Now i have to add another query as subsearch where i want to get column address for all the name returned from 1st result. I have fullname column in subsearch index which is same as name from 1st query . how to achieve this . 

[gcusello]

Hi @surekhasplunk ,

you have two choices:

• join: easier to implement but slower,
• stats: less easy but quicker, I prefer this!

using Join:

your_search_1 
| join name [ search your_search_2 | rename fullname AS name ]
| table rule result name department address

using stats:

your_search_1 OR your_search_2
| rename fullname AS name
| stats values(rule) AS rule values(result) AS result values(department) AS department values(address) AS address By name

Ciao.

Giuseppe