Hi,
I have two indexes basically like this:
indexA has field1, field2, field3
indexB has field4, field5, field6
field1=field4 (both are username)
I need a table showing:
field1, field2, field5, field6
In SQL, I can use join query, but I don't know how in SPL. Thank you for your help.
You can try something like this
index=indexA OR indexB |table field1,field2,field5,field6
Thanks for reply.
Actually, I learned from other post and used this:
indexA sourcetype...| rename field1 AS field | table field1, field2
| join field
[search indexB sourcetype...| rename field4 AS field | table field5, field6]
It works well.
Thanks again.
You can try something like this
index=indexA OR indexB |table field1,field2,field5,field6