topic Re: Include two index events without using JOIN command in Splunk Enterprise

How to include two index events without using JOIN command?

super_saiyan — Fri, 07 Oct 2022 14:45:39 GMT

Hi Splunkers,

There is one field is common in 2 indexes. Using that field how can i co-relate and make a table out of it without using JOIN, Append & Appendpipe command ? Because those command will take a lot of time and

Please refer to the below pictures

Thanks & regards

Re: Include two index events without using JOIN command

kamlesh_vaghela — Fri, 07 Oct 2022 14:08:23 GMT

@super_saiyan

Can you please try this?

index=IDX1 OR index=IDX2 | stats values(User_IP) as User_IP,values(Action) as Action, values(Comments) as Comments by ID

Change the index name and field name as per your requirement.

AKA- GOKU

Re: Include two index events without using JOIN command

super_saiyan — Fri, 07 Oct 2022 14:24:22 GMT

Are you a magician?

Because your magic spell(SPL) actually worked without giving any errors.

Thanks much

Re: Include two index events without using JOIN command

super_saiyan — Fri, 07 Oct 2022 14:32:32 GMT

But there is only one problem.
I am getting multiple comments values in a single table events.

Can we segregate that as well ?

@kamlesh_vaghela

Re: Include two index events without using JOIN command

kamlesh_vaghela — Fri, 07 Oct 2022 15:09:03 GMT

@super_saiyan

Glad to help you. 😀 . If the solution resolved your problem then please accept the answer to the close question.