I have two splunk queries and both have one common field with different values in each query. I need to combine both the queries and bring out the common values of the matching field in the result. I can create the lookup for one of the queries and correlate the matching field values in the second query but trying to do without lookup within the splunk query.
Example:
Query 1: index=abc.......| table field1, field2, field3
field1 have values 123, 434, 124, 567
Query 2: index=abc.......| table field1, test2,test3
field1 have values 123, 434, 865,524
I need the resultant to have the field with matching values in both queries like field1 as 123,434. Can you help me with this?
Have you tried using join?
index=abc query 1
| table field1, field2, field3
| join type=inner field1 [search (index=abc query 2) | fields field1, test2, test3]
| table field1, field2, field3, test2, test3
Have you tried using join?
index=abc query 1
| table field1, field2, field3
| join type=inner field1 [search (index=abc query 2) | fields field1, test2, test3]
| table field1, field2, field3, test2, test3
Thanks Rahman, Its working for me now. But I get the same results when I give the type=outer as well. What kind of difference will it make to my results.