topic Inner join on two hosts? in Splunk Enterprise

Inner join on two hosts?

mobicotic — Tue, 29 Sep 2020 08:14:49 GMT

How do I make an "inner join" in Splunk for this SQL query?

SELECT column_name(s)
FROM table1
INNER JOIN table2
ON table1.id=table2.user_id;

Re: Inner join on two hosts?

richgalloway — Thu, 31 Dec 2015 17:57:22 GMT

It goes something like this:

source=table1 | JOIN type=inner id [ SEARCH source=table2 | rename user_id AS id ]

You might find this document helpful: Splunk for SQL users

Re: Inner join on two hosts?

mobicotic — Mon, 04 Jan 2016 13:09:49 GMT

I'm new using Splunk.

Is "source" the same as a "host"?
Or how can I create tables?

Re: Inner join on two hosts?

richgalloway — Mon, 04 Jan 2016 13:34:00 GMT

Source and host are not the same. Source is the file containing the event (data) whereas host is the computer containing the source. You might want to check out the Splunk Tutorial (http://www.splunk.com/view/SP-CAAAH9U).
Splunk doesn't have "tables". It is not a database. Data is stored in indexes. Each entry in an index is an 'event'. Events typically contain a number of 'fields'. What constitutes a field depends on the type of event.
To create an index, go to Settings->Indexes and click the New Index button (you must be an admin to do this). Once you've created an index, you can then add data to it by selecting Settings->Add Data.

Re: Inner join on two hosts?

mobicotic — Mon, 04 Jan 2016 13:47:33 GMT

Thank you. It worked. 🙂

Re: Inner join on two hosts?

richgalloway — Mon, 04 Jan 2016 13:49:41 GMT

Please accept the answer.