Splunk Search

How to combine multiple independent search results in a single table row with multiple columns?

722624
Path Finder
  1. I have 5 different searches (each search itself contains commands join, multisearch etc...),
  2. From each search, I get 3 to 4 fields,
  3. I have to show these fields in a single row of a table in multiple columns (so table the contains columns 15-20)

Could you please help if this is possible?

Thank you
AB

0 Karma

jagadeeshm
Contributor

What you are probably looking for is an appendcol command.

You can try something like this -

your_search_query_1|appendcols [search your_search_query_2]

Reference # http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Appendcols

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...