topic Re: joining two values on single value in Splunk Enterprise

joining two values on single value

sompalle1 — Thu, 04 Mar 2021 03:46:52 GMT

Hi,

i have Total with me, (Table A)

Name Total

a 1000

b 1600

c 2500

Table B
From To Stage

0 1000 Excellent

1000 1500 Good

1500 2000 Poor

i need to join Total with From & To in order to get Stage.

Thanks.

Re: joining two values on single value

manjunathmeti — Thu, 04 Mar 2021 06:21:08 GMT

You can use the map command to run the TableB search query for each Total value in TableA.

index=s1 | table Name, Total | map search="search index=s2 From <= $Total$ AND To <= $Total$" | eval Total=$Total$, Name=$Name$ | fields Name, Total, Stage"

If this reply helps you, an upvote/like would be appreciated.

Re: joining two values on single value

sompalle1 — Thu, 04 Mar 2021 06:40:27 GMT

thanks for reply

nope not working

Re: joining two values on single value

manjunathmeti — Thu, 04 Mar 2021 06:42:28 GMT

Share your search query.