Splunk Search

How do i create this kind of relationship of two indexes

DiegoAlba
Explorer

For example
ID field1. ID field2
1 A. 1 X
2 B. 2. Y
1. E. 1. Z
AND I WHAT TO GET THIS
ID field1. field2
1. A. X
1. A. Z
2. B. Y
1. E. X
1. E. Z
Can someone of you help me please

Tags (2)
0 Karma

javiergn
Super Champion

Sorry I'm a bit confused about your example.

So assuming you have two tables:

  • Table1 (represented by mycsv.csv in the sample below) like this:

    ID,field1
    1,A
    2,B
    1,E

  • Table 2 (represented by mycsv2.csv in the sample below) like this:

    ID,field2
    1,X
    2,Y
    1,Z

The following code:

| inputcsv mycsv.csv 
| join max=0 ID [ | inputcsv mycsv2.csv ]

Will provide the following output:

ID  field1  field2
1   A   X
1   A   Z
2   B   Y
1   E   X
1   E   Z

As per the attached picture.

Is that what you are looking for?
alt text
Thanks,
J

DiegoAlba
Explorer

Hello Javier.

What you understood is exactly what i tried to Say.
Thank you so much!

0 Karma

javiergn
Super Champion

Hi @DiegoAlba,

If you are happy with the response please don't forget to mark this as answered so that others can benefit from it in future.

Thanks,
J

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...