https://community.splunk.com/t5/Reporting/How-to-connect-two-databases-from-different-servers-with-join/m-p/627667#M11784 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/253087">@razzeri</a>,</P><P>Join command default type is &nbsp;INNER which tries to match all possible fields. Can you try below?</P><P>Assuming connection A is your Incidents table.</P><LI-CODE lang="markup">| dbxquery query=[...] connection=A | join type=left max=0 INCIDENT_NUMBER [ dbxquery query=[...] connection=B]</LI-CODE><P>&nbsp;</P> Fri, 20 Jan 2023 02:26:01 GMT scelikok 2023-01-20T02:26:01Z https://community.splunk.com/t5/Reporting/How-to-connect-two-databases-from-different-servers-with-join/m-p/627643#M11782 <P>Hello guys. I received this task at my job, and I still need money in my pocket, so please help me :))&nbsp;<BR />I'm in a Network Operational team; maybe this will help you understand better the following description.<BR /><BR />So, In a single Splunk search <STRONG>I have to connect 2 databases, from different servers</STRONG>.&nbsp;<BR /><BR /><STRONG>One DB contains "Incidents"</STRONG>:&nbsp; <U>Incident ID, Start time of the Incident (Let's call it <STRONG>A</STRONG>), End time of the incident (<STRONG>B</STRONG>)</U><BR /><STRONG>The other DB contains&nbsp; "Call Complaints"</STRONG>:&nbsp; <U>The timestamp of each Call complaint (<STRONG>C</STRONG>)</U>.<BR /><BR />I need to find out the amount of call complaints for each incident. So, if C&gt;=A AND C&lt;=B, we count a call complaint for a specific incident, and we can move on to check the next C timestamp, and so on.&nbsp;<BR /><BR />I have issues right from the start. I tried to connect the databases with the next syntax:<BR /><BR />| dbxquery query=[...]&nbsp; connection=A<BR />| join<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [ dbxquery&nbsp; query=[...]&nbsp; connection=B]<BR /><BR />But, when I try a table command to see the interesting fields for me (Incident ID, A, B, C), the fields from the joined DB are looking the same on each line..<span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="Capture.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23453i4955E97C6847E396/image-size/large?v=v2&amp;px=999" role="button" title="Capture.PNG" alt="Capture.PNG" /></span><BR />Could you please help me with this?&nbsp;</P> Thu, 19 Jan 2023 21:18:01 GMT https://community.splunk.com/t5/Reporting/How-to-connect-two-databases-from-different-servers-with-join/m-p/627643#M11782 razzeri 2023-01-19T21:18:01Z https://community.splunk.com/t5/Reporting/How-to-connect-two-databases-from-different-servers-with-join/m-p/627645#M11783 <P>I think I need a new "time" field to link with both DB. But how??</P> Thu, 19 Jan 2023 20:22:57 GMT https://community.splunk.com/t5/Reporting/How-to-connect-two-databases-from-different-servers-with-join/m-p/627645#M11783 razzeri 2023-01-19T20:22:57Z https://community.splunk.com/t5/Reporting/How-to-connect-two-databases-from-different-servers-with-join/m-p/627667#M11784 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/253087">@razzeri</a>,</P><P>Join command default type is &nbsp;INNER which tries to match all possible fields. Can you try below?</P><P>Assuming connection A is your Incidents table.</P><LI-CODE lang="markup">| dbxquery query=[...] connection=A | join type=left max=0 INCIDENT_NUMBER [ dbxquery query=[...] connection=B]</LI-CODE><P>&nbsp;</P> Fri, 20 Jan 2023 02:26:01 GMT https://community.splunk.com/t5/Reporting/How-to-connect-two-databases-from-different-servers-with-join/m-p/627667#M11784 scelikok 2023-01-20T02:26:01Z