Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Joining/Appending queries

$
0
0
Hi guys, quick question here: I have the following queries: Q1: Sub-Search for userID Q2: Main search, which provides username and department Currently I can get a table with userID, Username & Department. I would like to include in the result table each user's last access timestamp, but this field is in the sub-search index. What is the best approach to achieve that? Table: UserID | Username | Department | Last Access Thank you.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>