Hello, I'm new to splunk. I would like to know how to join several sources and have the results stats displayed from both sources. In the example below I want to see the top 30 orders by url link. The orders is in one source(x) and the url link is another(y) both sources share a common url id.
Hi Valisha2005,
based on the generic example you provided, you can use something like this:
source=x OR source=y
| stats count values(*) AS * by url_id
| sort - count
| head limit=30
Read this answer https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo... to learn more about this topic.
Hope this helps ...
cheers, MuS
Hi Valisha2005,
based on the generic example you provided, you can use something like this:
source=x OR source=y
| stats count values(*) AS * by url_id
| sort - count
| head limit=30
Read this answer https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo... to learn more about this topic.
Hope this helps ...
cheers, MuS