Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Is there a way to APPEND events based on a field value from main search?

$
0
0
I have a use case where a user will input a username and Splunk should return results for that username. But, there are seperate events related that username which do not contain the username field, but instead have the same mac address field. The following command is what I wish would work, but I know the append command doesn't allow you to pass data from the main search. index=my_index UserName=myuser | table _time UserName MacAddress Message | append MacAddress [search index=my_index | table _time UserName MacAddress Message] Does anybody know how I can acomplish this?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>