Splunk Search

How to combine 2 searches with same value and field name.

Allene139
Explorer

I have 2 searches and I want to link 2 together in one table.

The first search:

 

index=very_big_index caseNumber=1234567799

| table _time Name caseNumber UID phone.

 

This displays the following as expected, but the phone field is blank:

_timeNamecaseNumberUIDphone
11APR2022John Smith1234567799111222333444555666777 

 

The second search with the UID yields the phone number but nothing else:

 

index=very_big_index 111222333444555666777
| stats values(phone) as phone

 

results:

phone
123-555-1234

 

How can I efficiently link these 2 searches together using the common field name/value of UID/111222333444555666777

Labels (3)
0 Karma

Stefanie
Builder

In your first search, 

index=very_big_index caseNumber=1234567799

| table _time Name caseNumber UID phone

 

Is phone blank because the value should be "phone_number"?

 

Does this search not return your results? 

index=very_big_index caseNumber=1234567799

| table _time Name caseNumber UID phone_number

 

 

0 Karma

Allene139
Explorer

Apologies for the confusion. The name of the field is "phone." But I used "phone_number" when I was sanitizing the data for this post. I fixed the post. Thank you

0 Karma

Allene139
Explorer

That didn't work. The phone number field is blank. But thank you.

0 Karma

blbr123
Path Finder

index=very_big_index caseNumber=1234567799 111222333444555666777 | stats values(phone_number) as phone by _time Name caseNumber UID

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...