Splunk Search

How to join or search fields from two different indexes with a common field

vnguyen46
Contributor

Hi,
I have two indexes basically like this:
indexA has field1, field2, field3
indexB has field4, field5, field6
field1=field4 (both are username)
I need a table showing:
field1, field2, field5, field6

In SQL, I can use join query, but I don't know how in SPL. Thank you for your help.

1 Solution

iamsplunker31
Path Finder

You can try something like this

index=indexA OR indexB |table field1,field2,field5,field6

View solution in original post

vnguyen46
Contributor

Thanks for reply.

Actually, I learned from other post and used this:
indexA sourcetype...| rename field1 AS field | table field1, field2
| join field
[search indexB sourcetype...| rename field4 AS field | table field5, field6]

It works well.
Thanks again.

iamsplunker31
Path Finder

You can try something like this

index=indexA OR indexB |table field1,field2,field5,field6

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...