Splunk Search

Combine multiple tables in single alert

twh1
Communicator

I have 3 different searches. All are printing separate tables. I want to configure the single alert, which will contain all 3 table one after other. Is this feature available in Splunk 7.1? I want the email content like below.

table 1

**col1 col2 col3**
row1 row1 row1
row2 row2 row2

table 2

**col1 col2 col3**
row1 row1 row1
row2 row2 row2

table 3

**col1 col2 col3**
row1 row1 row1
row2 row2 row2
0 Karma

dmarling
Builder

Are the column names all the same? Also are these three searches scheduled at all? If not you can just have a union run all three searches and produce the results to a single table:

| union
    [search search1
    | eval Type="Search 1"
    | table Type col1 col2 col3]
    [search search2
    | eval Type="Search 2"
    | table Type col1 col2 col3]
    [search search3
    | eval Type="Search 3"
    | table Type col1 col2 col3]
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma

twh1
Communicator

Hi @dmarling ,
All there tables have different field names. I tried for union command, but it is merging all table columns and displaying the data.

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...