Reporting

How can I put two search results into one report?

zeaxodarap
Explorer

I want to build a report which can show the result of two fields from different searches?Can splunk do that? Thank u for any advice.

Tags (1)

bwooden
Splunk Employee
Splunk Employee

Yes. You may use the append command to append results of another search. Here is an unimaginative example of appending the results of a search for one source with the results of a search for another (ignoring the fact that this could be done in one search):

index=_internal source=*metrics| append [search index=_internal source=*access.log] | stats count by source

zeaxodarap
Explorer

Thank u very much

0 Karma
Get Updates on the Splunk Community!

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...