Splunk Search

How to combine 2 searches with same value and field name.

Allene139
Explorer

I have 2 searches and I want to link 2 together in one table.

The first search:

 

index=very_big_index caseNumber=1234567799

| table _time Name caseNumber UID phone.

 

This displays the following as expected, but the phone field is blank:

_timeNamecaseNumberUIDphone
11APR2022John Smith1234567799111222333444555666777 

 

The second search with the UID yields the phone number but nothing else:

 

index=very_big_index 111222333444555666777
| stats values(phone) as phone

 

results:

phone
123-555-1234

 

How can I efficiently link these 2 searches together using the common field name/value of UID/111222333444555666777

Labels (3)
0 Karma

Stefanie
Builder

In your first search, 

index=very_big_index caseNumber=1234567799

| table _time Name caseNumber UID phone

 

Is phone blank because the value should be "phone_number"?

 

Does this search not return your results? 

index=very_big_index caseNumber=1234567799

| table _time Name caseNumber UID phone_number

 

 

0 Karma

Allene139
Explorer

Apologies for the confusion. The name of the field is "phone." But I used "phone_number" when I was sanitizing the data for this post. I fixed the post. Thank you

0 Karma

Allene139
Explorer

That didn't work. The phone number field is blank. But thank you.

0 Karma

blbr123
Path Finder

index=very_big_index caseNumber=1234567799 111222333444555666777 | stats values(phone_number) as phone by _time Name caseNumber UID

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...