Splunk Search

For each result in a search, make a second search to extract a couple of fields from other records?

bowesmana
SplunkTrust
SplunkTrust

I have two types of data input

  1. login records containing at least Userid, Name, LoginDate
  2. user records containing at least Userid, Company

The Userid is common. I am producing a report of the top 20 users logging into the system in a month from data set 1, but want to include the company from data set 2 in each line of the report, so my report will have

Name, Company, Count of logins

I have a search

sourcetype=logins | top showperc=false countfield=Logins limit=20 Name

and that shows the name and count. In order to get the company I have read lots and have so far got

sourcetype=logins | top showperc=false countfield=Logins limit=20 Name | append [ search sourcetype=users | top 1 showperc=false Company by UserId ]

Which is giving me sort of the right information but not correctly combined, i.e. I get the first 20 lines showing Name and Count and then more lines giving me the company name and some other counts and info

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Here we go - Thanks for accepting the answer 😉

first search | join Userid [ second search ]

cheers, MuS

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Perfect, you are my hero forever MuS! Thanks! I can't mark this as the correct answer as it's just a comment. If you write an answer, I'll mark it as the correct one.

MuS
SplunkTrust
SplunkTrust

Here we go - Thanks for accepting the answer 😉

first search | join Userid [ second search ]

cheers, MuS

bowesmana
SplunkTrust
SplunkTrust

OK, I changed append to appendcols, but that's still not right as it's appending unrelated content to the original rows.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...