Splunk Search

JOIN two tables in Splunk

kthakkar
New Member

Need to extract the value of 'A' from Query 1 -
Then do a JOIN to extract the value of 'A' if they occur in Query 2
Match the value of 'A' to corresponding values of 'B' which are a part of the Query 2.

I am able to get the JOIN working and it gives me all the A's that occur in the Query 2. Now I need to extract the value of corresponding 'B' in Query 2.

Tags (1)
0 Karma

krugger
Communicator

More information would be nice, but from what you wrote I can suggest this:

index="AAA" somecondition |
rename somefieldA as commonfield |
join commonfield [ search index="BBB" anothercondition | table commonfield,additionalinfoB ]

This will produce a table with the information from AAA plus the additional information from B where somefieldA is equal to commonfield in B.

lguinn2
Legend

Sorry but this is not enough information. Can we see the actual query? We especially need to see the query where join is working. Also, the 'A' query and the 'B' query.

Also, what is the criteria for joining 'A' and 'B'? is there a transaction id or key that is common to both queries?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...