https://community.splunk.com/t5/Splunk-Search/Splunk-SPL-join/m-p/482161#M135085 <P>Hi Experts,</P> <P>Please suggest how to join two Splunk index output.<BR /> I have two indexes in first index i want to fetch only that data that occurred in holiday list occurrence-date field<BR /><BR /> index=monitor<BR /> index=holiday_list earliest=0 latest=now| dedup OCCURRENCEDATE| table OCCURRENCEDATE</P> Thu, 23 Apr 2020 01:24:57 GMT arun_kant_sharm 2020-04-23T01:24:57Z https://community.splunk.com/t5/Splunk-Search/Splunk-SPL-join/m-p/482161#M135085 <P>Hi Experts,</P> <P>Please suggest how to join two Splunk index output.<BR /> I have two indexes in first index i want to fetch only that data that occurred in holiday list occurrence-date field<BR /><BR /> index=monitor<BR /> index=holiday_list earliest=0 latest=now| dedup OCCURRENCEDATE| table OCCURRENCEDATE</P> Thu, 23 Apr 2020 01:24:57 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-SPL-join/m-p/482161#M135085 arun_kant_sharm 2020-04-23T01:24:57Z https://community.splunk.com/t5/Splunk-Search/Splunk-SPL-join/m-p/482162#M135086 <P>Try this:</P> <PRE><CODE>index=monitor [search index=holiday_list earliest=0 latest=now| stats count by OCCURRENCEDATE | fields OCCURRENCEDATE] </CODE></PRE> Thu, 23 Apr 2020 06:56:10 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-SPL-join/m-p/482162#M135086 manjunathmeti 2020-04-23T06:56:10Z