topic Re: How to join or search fields from two different indexes with a common field in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-join-or-search-fields-from-two-different-indexes-with-a/m-p/503129#M139998 <P>Thanks for reply.</P> <P>Actually, I learned from other post and used this:<BR /> indexA sourcetype...| rename field1 AS field | table field1, field2<BR /> | join field<BR /> [search indexB sourcetype...| rename field4 AS field | table field5, field6]</P> <P>It works well.<BR /> Thanks again.</P> Sat, 19 Oct 2019 02:52:29 GMT vnguyen46 2019-10-19T02:52:29Z How to join or search fields from two different indexes with a common field https://community.splunk.com/t5/Splunk-Search/How-to-join-or-search-fields-from-two-different-indexes-with-a/m-p/503127#M139996 <P>Hi,<BR /> I have two indexes basically like this:<BR /> indexA has field1, field2, field3<BR /> indexB has field4, field5, field6<BR /> <STRONG>field1=field4</STRONG> (both are username)<BR /> I need a table showing:<BR /> field1, field2, field5, field6</P> <P>In SQL, I can use join query, but I don't know how in SPL. Thank you for your help.</P> Fri, 18 Oct 2019 22:55:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-or-search-fields-from-two-different-indexes-with-a/m-p/503127#M139996 vnguyen46 2019-10-18T22:55:47Z Re: How to join or search fields from two different indexes with a common field https://community.splunk.com/t5/Splunk-Search/How-to-join-or-search-fields-from-two-different-indexes-with-a/m-p/503128#M139997 <P>You can try something like this </P> <P>index=indexA OR indexB |table field1,field2,field5,field6</P> Sat, 19 Oct 2019 02:20:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-or-search-fields-from-two-different-indexes-with-a/m-p/503128#M139997 iamsplunker31 2019-10-19T02:20:53Z Re: How to join or search fields from two different indexes with a common field https://community.splunk.com/t5/Splunk-Search/How-to-join-or-search-fields-from-two-different-indexes-with-a/m-p/503129#M139998 <P>Thanks for reply.</P> <P>Actually, I learned from other post and used this:<BR /> indexA sourcetype...| rename field1 AS field | table field1, field2<BR /> | join field<BR /> [search indexB sourcetype...| rename field4 AS field | table field5, field6]</P> <P>It works well.<BR /> Thanks again.</P> Sat, 19 Oct 2019 02:52:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-or-search-fields-from-two-different-indexes-with-a/m-p/503129#M139998 vnguyen46 2019-10-19T02:52:29Z