topic Re: Merging two data sources in Splunk Search

Merging two data sources

keishamtcs — Fri, 27 Jul 2018 12:29:50 GMT

Hi..

Need some help in merging two search result.

i have one source with below result as such -

CommonIndex host Max
WinUnix appdcos 23.10
WinUnix hpmail 91.80

Another search result with output as such -

CommonIndex host Max
WinUnix ADDS 20.25
WinUnix BCMP 75.16

How can i reproduce the results like below in a single table. I have tried join,append but output is not correct.

CommonIndex host Max
WinUnix appdcos 23.10
WinUnix hpmail 91.80
WinUnix ADDS 20.25
WinUnix BCMP 75.16

thambisetty — Fri, 27 Jul 2018 12:57:35 GMT

Hi,
try something like below,

index=a | table CommonIndex host Max | append [|search index=b | table CommonIndex host Max]

if fields are common in two indexes. you can try something like below,

index=a OR index=b | table CommonIndex host Max

richgalloway — Fri, 27 Jul 2018 12:57:49 GMT

It would help to see your two searches, but the general way to do it is to merge the two queries. You shouldn't need to use append or join.

(index=index1 sourcetype=st1) OR (index=index1 sourcetype=st2) | ... | table ComminIndex host Max