Splunk Enterprise

Inner join on two hosts?

mobicotic
New Member

How do I make an "inner join" in Splunk for this SQL query?

SELECT column_name(s)
FROM table1
INNER JOIN table2
ON table1.id=table2.user_id;

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It goes something like this:

source=table1 | JOIN type=inner id [ SEARCH source=table2 | rename user_id AS id ] 

You might find this document helpful: Splunk for SQL users

---
If this reply helps you, Karma would be appreciated.

mobicotic
New Member

I'm new using Splunk.

Is "source" the same as a "host"?
Or how can I create tables?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Source and host are not the same. Source is the file containing the event (data) whereas host is the computer containing the source. You might want to check out the Splunk Tutorial (http://www.splunk.com/view/SP-CAAAH9U).
Splunk doesn't have "tables". It is not a database. Data is stored in indexes. Each entry in an index is an 'event'. Events typically contain a number of 'fields'. What constitutes a field depends on the type of event.
To create an index, go to Settings->Indexes and click the New Index button (you must be an admin to do this). Once you've created an index, you can then add data to it by selecting Settings->Add Data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mobicotic
New Member

Thank you. It worked. 🙂

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please accept the answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...