Say I have two scheduled reports with results like: report1 - source destination score1 report2 - source destination score2 how can I join the results of these two scheduled reports so that I can see combined report: source destination score1 score2 (note, the actual reports are far more complex and I cannot simply combine the queries to make one new report) I have considered (and solved) writing the output to a lookup table and doing the joins from those. There is some appeal to that, but I would like to know how to do it without lookup tables. ... View more

This is not so much a question. But I don't see a solutions.splunk.com, so I will post this solution here, improve it with any feedback, and post the improved pattern as an answer. Anti-pattern: map is a subsearch, so mapped searches are limited in the results that they can return. example: https://answers.splunk.com/answers/589791/can-i-do-kmeans-by-a-for-a-column-by-a-column.html pattern: loopable lookup table, create a lookup table that will provide a single successive value with each run. how-to 1) create a table of values that you would like to loop on, with columns for loopable value and status. Status needs to be something that can be compared against. For example, all destination ports visited in a time period | tstats summariesonly=t first(All_Traffic.dest_port) as port from datamodel=Network_Traffic.All_Traffic where All_Traffic.session_id!=0 All_Traffic.dest_zone=external by All_Traffic.dest_port | eval status="A" | fields + port status | outputlookup test_loop_ports.csv 2) Do some work using the minimum value from the loopable table and update the minimum value's status. tstats summariesonly=t count from datamodel=Network_Traffic.All_Traffic where [|inputlookup test_loop_ports.csv where NOT status=done | stats min(port) as All_Traffic.dest_port] by All_Traffic.dest_port | outputlookup append=t test_port_count.csv | eval status="done", port='All_Traffic.dest_port' | append [|inputlookup test_loop_ports.csv] | stats max(status) as status by port | outputlookup test_loop_ports.csv How will this look? lets say that the first query returns ports 0,53,80.443, so test_loop_ports.csv looks like port status 0 A 53 A 80 A 443 A On the first run of the second query, I get a new table and a modified test_loop_ports.csv test_loop_ports: port status 0 done 53 A 80 A 443 A test_port_count.csv port count 0 10532 on the second run of the second query, port 0 has a status of "done", so the new minimum port is 53. After this run, our tables look like: test_loop_ports: port status 0 done 53 done 80 A 443 A test_port_count.csv port count 0 10532 53 96103 and so on until all statuses are done test_loop_ports: port status 0 done 53 done 80 done 443 done test_port_count.csv port count 0 10532 53 96103 80 909 443 1201 The two problems that I have with this process are that I need to schedule the queries in a way that guarantees all values are processed. To do this I need to know about how long each will run and then schedule based on that guess. Since the loopable lookup table is updated at the end, I cannot start the next query until the first one is done (otherwise I get the same minimum value on the second query). This means that I loose the optimization of running queries in parallel. ... View more