topic Re: rename fields having the same name in JOIN command in Splunk Search

How to rename fields having the same name in JOIN command?

piscriddo — Thu, 30 Jul 2020 05:00:12 GMT

Hi,

I am executing a right join on two searches. Unfortunately, both search results have the same field names.

How can I rename the field of one search only, and not the other, in order to be able to display these values in a table?

Example

Search A: Order_id = 123 Operation = authorize Result = 200 Search B: Order_id = 123 Operation = secure Result = 200

I want to right join Search A to Search B in order to obtain:

order_id	authorize	secure
123	200	200

Thanks!

isoutamo — Wed, 29 Jul 2020 16:08:16 GMT

you could try this:

r. Ismo

bowesmana — Wed, 29 Jul 2020 23:13:09 GMT

It's often useful in Splunk to consider how you would do this without using join.

Typically to avoid join, you would include both data sets in the original search and then do aggregations on those as needed.

So, if you just had search A OR search B you would then be able to use @isoutamo 's chart statement to render the results.