https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-Splunk-queries-and-extract-the-matching/m-p/455452#M128783 <P>I have two splunk queries and both have one common field with different values in each query. I need to combine both the queries and bring out the common values of the matching field in the result. I can create the lookup for one of the queries and correlate the matching field values in the second query but trying to do without lookup within the splunk query.</P> <P>Example: </P> <PRE><CODE>Query 1: index=abc.......| table field1, field2, field3 field1 have values 123, 434, 124, 567 Query 2: index=abc.......| table field1, test2,test3 field1 have values 123, 434, 865,524 </CODE></PRE> <P>I need the resultant to have the field with matching values in both queries like field1 as 123,434. Can you help me with this?</P> Wed, 25 Jul 2018 01:52:00 GMT arrangineni 2018-07-25T01:52:00Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-Splunk-queries-and-extract-the-matching/m-p/455452#M128783 <P>I have two splunk queries and both have one common field with different values in each query. I need to combine both the queries and bring out the common values of the matching field in the result. I can create the lookup for one of the queries and correlate the matching field values in the second query but trying to do without lookup within the splunk query.</P> <P>Example: </P> <PRE><CODE>Query 1: index=abc.......| table field1, field2, field3 field1 have values 123, 434, 124, 567 Query 2: index=abc.......| table field1, test2,test3 field1 have values 123, 434, 865,524 </CODE></PRE> <P>I need the resultant to have the field with matching values in both queries like field1 as 123,434. Can you help me with this?</P> Wed, 25 Jul 2018 01:52:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-Splunk-queries-and-extract-the-matching/m-p/455452#M128783 arrangineni 2018-07-25T01:52:00Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-Splunk-queries-and-extract-the-matching/m-p/455453#M128784 <P>Have you tried using join?</P> <PRE><CODE>index=abc query 1 | table field1, field2, field3 | join type=inner field1 [search (index=abc query 2) | fields field1, test2, test3] | table field1, field2, field3, test2, test3 </CODE></PRE> Wed, 25 Jul 2018 03:26:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-Splunk-queries-and-extract-the-matching/m-p/455453#M128784 rahmanazhar 2018-07-25T03:26:52Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-Splunk-queries-and-extract-the-matching/m-p/455454#M128785 <P>Thanks Rahman, Its working for me now. But I get the same results when I give the type=outer as well. What kind of difference will it make to my results.</P> Wed, 25 Jul 2018 14:55:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-Splunk-queries-and-extract-the-matching/m-p/455454#M128785 arrangineni 2018-07-25T14:55:21Z