https://community.splunk.com/t5/Getting-Data-In/How-to-merge-data-from-2-index-with-common-field/m-p/404431#M71809 <P>I have the following data in 2 different indexes that I want to merge based on the common email field. <BR /> Index B is a big dataset containing around 125k events. I tried using JOIN- but it has limitation and won't return desired results.</P> <PRE><CODE>Index A email event abc@xyz.com click Index B email field2 . field3 . field4 . field5 abc@xyz.com blah . blah . blah blah </CODE></PRE> <P>Final output should be </P> <PRE><CODE>email event . field2 . field3 . field4 . field5 </CODE></PRE> Tue, 04 Jun 2019 22:34:56 GMT kiranpatil1985 2019-06-04T22:34:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-merge-data-from-2-index-with-common-field/m-p/404431#M71809 <P>I have the following data in 2 different indexes that I want to merge based on the common email field. <BR /> Index B is a big dataset containing around 125k events. I tried using JOIN- but it has limitation and won't return desired results.</P> <PRE><CODE>Index A email event abc@xyz.com click Index B email field2 . field3 . field4 . field5 abc@xyz.com blah . blah . blah blah </CODE></PRE> <P>Final output should be </P> <PRE><CODE>email event . field2 . field3 . field4 . field5 </CODE></PRE> Tue, 04 Jun 2019 22:34:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-merge-data-from-2-index-with-common-field/m-p/404431#M71809 kiranpatil1985 2019-06-04T22:34:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-merge-data-from-2-index-with-common-field/m-p/404432#M71810 <P>@kiranpatil1985,</P> <P>Try,</P> <PRE><CODE>(index="A" OR index="B")|stats values(event) as event,values(field2) as field2,.....,values(fieldn) as fieldn by email </CODE></PRE> Wed, 05 Jun 2019 02:55:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-merge-data-from-2-index-with-common-field/m-p/404432#M71810 renjith_nair 2019-06-05T02:55:16Z