Splunk Search

Join two table in Splunk

orakanggo
New Member

How can I join two table in Splunk using query like this?

select dialog.id, dialog.callId, dialogParty_dialog_id, attributeKey_id, attributeValue
from dialog, descriptionsattribute
where callid = 'AL_a8wKVUUuX2qY7DgmBIg..' and dialog.id = dialogParty_dialog_id;"

thank you and regards,
Akas

Tags (2)
0 Karma

Ayn
Legend

What do you mean by "table"? Splunk doesn't have tables. It does have join and similar operators though, but it's often not a 100% good idea to try to implement the exact same concepts to Splunk searches as with SQL searches. That said, this "Splunk for SQL users" guide should prove useful.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk

orakanggo
New Member

sorry, I have two sourcetypes, first is CALL-DIALOG which is point to dialog and second is CALL-DESCRIPTIONS which is point to descriptionsattribute.

I have run this command but no luck

sourcetype="CALL-DIALOG" callId="AL_a8wKVUUuX2qY7DgmBIg.." | fields id, callId | join id, dialogParty_dialog_id [search sourcetype="CALL-DESCRIPTIONS" | fields dialogParty_dialog_id, attributeKey_id, attributeValue]

thanks

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...