Splunk Search

Combine multiple tables in single alert

twh1
Communicator

I have 3 different searches. All are printing separate tables. I want to configure the single alert, which will contain all 3 table one after other. Is this feature available in Splunk 7.1? I want the email content like below.

table 1

**col1 col2 col3**
row1 row1 row1
row2 row2 row2

table 2

**col1 col2 col3**
row1 row1 row1
row2 row2 row2

table 3

**col1 col2 col3**
row1 row1 row1
row2 row2 row2
0 Karma

dmarling
Builder

Are the column names all the same? Also are these three searches scheduled at all? If not you can just have a union run all three searches and produce the results to a single table:

| union
    [search search1
    | eval Type="Search 1"
    | table Type col1 col2 col3]
    [search search2
    | eval Type="Search 2"
    | table Type col1 col2 col3]
    [search search3
    | eval Type="Search 3"
    | table Type col1 col2 col3]
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma

twh1
Communicator

Hi @dmarling ,
All there tables have different field names. I tried for union command, but it is merging all table columns and displaying the data.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...