Splunk Search

How to construct a search that combines two different searches with no common fields?

pavanae
Builder

I'd joined two different searches and trying to display the search 2 table for search 1 users. Both the searches have the usernames field different

search 1 displays usernames with field name "usernumber"
search 2 displays usernames with field name "userid"

I know if both the searches has same field name i can display as below

search 1 | fields userid | join userid [search 2]

But here the scenario is different. Even though the field names are different, how can i combine those two searches?

0 Karma
1 Solution

sundareshr
Legend

Try this

(base search for search 1) OR (base search for search 2) | eval user=coalesce(usernumber, userid) | stats values(*) as * by user

*OR* if you must user join (not recommeded), just rename the field in the sub-search

search 1 | fields userid | join userid [search | fields | usernumber | rename usernumber AS userid] | ...

View solution in original post

0 Karma

sundareshr
Legend

Try this

(base search for search 1) OR (base search for search 2) | eval user=coalesce(usernumber, userid) | stats values(*) as * by user

*OR* if you must user join (not recommeded), just rename the field in the sub-search

search 1 | fields userid | join userid [search | fields | usernumber | rename usernumber AS userid] | ...
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...