https://community.splunk.com/t5/Splunk-Search/How-do-I-join-different-events-on-an-ID-with-different-source/m-p/443944#M125916 <P>Here's something to try.</P> <PRE><CODE>index=myindex (source1 OR source2) | stats values(infofield1) as infofield1 values(infofield2) as infofield2 by id | fillnull infofield2 </CODE></PRE> Wed, 24 Oct 2018 12:47:36 GMT richgalloway 2018-10-24T12:47:36Z https://community.splunk.com/t5/Splunk-Search/How-do-I-join-different-events-on-an-ID-with-different-source/m-p/443943#M125915 <P>Hello everybody,</P> <P>I have many messages with two different source types and an ID and a information field. For every ID, there is one message from source 1 and one from source 2. I need to display to every ID the information field of both source types:</P> <P>Example:</P> <H2>ID | Source 1 | Source 2 |</H2> <P>1 | info field from source 1 | info field from source 2 |<BR /> 2 |info field from source 2 | null |</P> <P>If there is no second event to an ID from the other source, "null" should be displayed.</P> <P>How can I perform this join/combination?</P> <P>My try: </P> <PRE><CODE>index=myindex source1 | table id, infofield1 | join type=outer [search index=myindex source2 |table id, infofield2] </CODE></PRE> <P>Thank you in advance!</P> Wed, 24 Oct 2018 07:29:25 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-join-different-events-on-an-ID-with-different-source/m-p/443943#M125915 nikosattlermhp 2018-10-24T07:29:25Z https://community.splunk.com/t5/Splunk-Search/How-do-I-join-different-events-on-an-ID-with-different-source/m-p/443944#M125916 <P>Here's something to try.</P> <PRE><CODE>index=myindex (source1 OR source2) | stats values(infofield1) as infofield1 values(infofield2) as infofield2 by id | fillnull infofield2 </CODE></PRE> Wed, 24 Oct 2018 12:47:36 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-join-different-events-on-an-ID-with-different-source/m-p/443944#M125916 richgalloway 2018-10-24T12:47:36Z