topic Re: How do you append data from a different source in the same Index? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-do-you-append-data-from-a-different-source-in-the-same-Index/m-p/459639#M93943 <P>If above solution resolved your problem, can you please accept the answer?</P> Wed, 07 Nov 2018 07:05:36 GMT Akumar294 2018-11-07T07:05:36Z How do you append data from a different source in the same Index? https://community.splunk.com/t5/Getting-Data-In/How-do-you-append-data-from-a-different-source-in-the-same-Index/m-p/459637#M93941 <P>I have one Index that has two different sources. One source has current data and another has historical data. Both have the same fields. I want to append data current in historical data incase there are any changes in current data by user that should be reflected in historical data. I want one side current data in column, &amp; on the other side, there would be historical data in another column.</P> <P>Trying below command</P> <PRE><CODE>source="historical" PERIOD="Q1" YEAR="2012" | Table PERIOD, YEAR | append [index=prod source="current" PERIOD="Q2" YEAR="2012" | Table PERIOD, YEAR] </CODE></PRE> Tue, 06 Nov 2018 03:50:38 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-append-data-from-a-different-source-in-the-same-Index/m-p/459637#M93941 maheshsat 2018-11-06T03:50:38Z Re: How do you append data from a different source in the same Index? https://community.splunk.com/t5/Getting-Data-In/How-do-you-append-data-from-a-different-source-in-the-same-Index/m-p/459638#M93942 <P>Please try like below:</P> <PRE><CODE>index="your index" source="historical" PERIOD="Q1" YEAR="2012" |table PERIOD, YEAR |join [search index=prod source="current" PERIOD="Q2" YEAR="2012" |table PERIOD, YEAR] </CODE></PRE> Tue, 06 Nov 2018 10:14:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-append-data-from-a-different-source-in-the-same-Index/m-p/459638#M93942 Akumar294 2018-11-06T10:14:03Z Re: How do you append data from a different source in the same Index? https://community.splunk.com/t5/Getting-Data-In/How-do-you-append-data-from-a-different-source-in-the-same-Index/m-p/459639#M93943 <P>If above solution resolved your problem, can you please accept the answer?</P> Wed, 07 Nov 2018 07:05:36 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-you-append-data-from-a-different-source-in-the-same-Index/m-p/459639#M93943 Akumar294 2018-11-07T07:05:36Z