Splunk Search

Join Statment

hartfoml
Motivator

OK the last question might have bee to hard for the group. So try this one.

I am using the join statement like this "search1 | join id [search2]"

In the primary search and in the sub-search there is a field called "id" but they do not always match.

I want to join on the field "search1 id=*" to "search2 key=*". "ID" and "KEY" always match.

I tried this but it did not work "search1 | join id:key [search2]"

I tried this but it did not work "search1 | join id,key [search2]"

I tried this to see if it would auto join, no luck "search1 | join [search2]"

Any help would be great.

Tags (1)
0 Karma
1 Solution

jonuwz
Influencer

Sounds like you just need to abstract the different fields into something common you can join on

... | search1 | eval join_field=id | join join_field [ search2 | eval join_field=key ]

View solution in original post

jonuwz
Influencer

Sounds like you just need to abstract the different fields into something common you can join on

... | search1 | eval join_field=id | join join_field [ search2 | eval join_field=key ]

fflloovee
New Member

"eval join_field=id" Can i change id to field name because i have many id and want to join by id
i try to use "join type=left ID" and some value are missing(i search each value and see there refernce with id but still missing)

0 Karma

hartfoml
Motivator

you have done it again twice in one day 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...