https://community.splunk.com/t5/Splunk-Search/Joining-two-fields-with-different-names/m-p/57045#M13946 <P>Use an eval to create the missing field in one of the searches.</P> <P>example :<BR /> <CODE>source=fileA | JOIN fieldA [ search source=fileB | eval fieldA=fieldB ]</CODE></P> Thu, 06 Jun 2013 16:07:03 GMT yannK 2013-06-06T16:07:03Z https://community.splunk.com/t5/Splunk-Search/Joining-two-fields-with-different-names/m-p/57044#M13945 <P>I am trying to join two fields from different indexers, they both return IP Addresses but are under different field names. </P> Thu, 06 Jun 2013 15:31:08 GMT https://community.splunk.com/t5/Splunk-Search/Joining-two-fields-with-different-names/m-p/57044#M13945 JoeSco27 2013-06-06T15:31:08Z https://community.splunk.com/t5/Splunk-Search/Joining-two-fields-with-different-names/m-p/57045#M13946 <P>Use an eval to create the missing field in one of the searches.</P> <P>example :<BR /> <CODE>source=fileA | JOIN fieldA [ search source=fileB | eval fieldA=fieldB ]</CODE></P> Thu, 06 Jun 2013 16:07:03 GMT https://community.splunk.com/t5/Splunk-Search/Joining-two-fields-with-different-names/m-p/57045#M13946 yannK 2013-06-06T16:07:03Z