https://community.splunk.com/t5/Splunk-Search/how-to-join-the-two-tables/m-p/512362#M143701 <P>Are you going to talk about Splunk? where is the field name?&nbsp;<BR /><BR />sample:<BR /><BR /></P><LI-CODE lang="markup">| makeresults | eval Atable=split("str1,str2,str3",",") | mvexpand Atable | append [|makeresults| eval _raw="str,val,oval str4,val1,oval1 str5,val2,oval2 str6,val3,oval3" | multikv forceheader=1 ] | eventstats list(Atable) as Atable | mvexpand Atable | where !isnull(linecount) | table Atable str val oval</LI-CODE><P>&nbsp;</P> Tue, 04 Aug 2020 12:32:57 GMT to4kawa 2020-08-04T12:32:57Z https://community.splunk.com/t5/Splunk-Search/how-to-join-the-two-tables/m-p/512242#M143660 <P>I have 2 tables<BR />I'd like to join the tables.</P><P>for example :&nbsp;</P><P>A table</P><TABLE border="0" width="72" cellspacing="0" cellpadding="0"><TBODY><TR><TD width="72" height="22">str1</TD></TR><TR><TD height="22">str2</TD></TR><TR><TD height="22">str3</TD></TR></TBODY></TABLE><P><BR />B table</P><TABLE border="0" width="216" cellspacing="0" cellpadding="0"><TBODY><TR><TD width="72" height="22">str4</TD><TD width="72">val1</TD><TD width="72">oval1</TD></TR><TR><TD height="22">str5</TD><TD>val2</TD><TD>oval2</TD></TR><TR><TD height="22">str6</TD><TD>val3</TD><TD>oval3</TD></TR></TBODY></TABLE><P><BR />result : A + B table</P><TABLE border="0" width="288" cellspacing="0" cellpadding="0"><TBODY><TR><TD width="72" height="22">str1</TD><TD width="72">str4</TD><TD width="72">val1</TD><TD width="72">oval1</TD></TR><TR><TD height="22">str1</TD><TD>str5</TD><TD>val2</TD><TD>oval2</TD></TR><TR><TD height="22">str1</TD><TD>str6</TD><TD>val3</TD><TD>oval3</TD></TR><TR><TD height="22">str2</TD><TD>str4</TD><TD>val1</TD><TD>oval1</TD></TR><TR><TD height="22">str2</TD><TD>str5</TD><TD>val2</TD><TD>oval2</TD></TR><TR><TD height="22">str2</TD><TD>str6</TD><TD>val3</TD><TD>oval3</TD></TR><TR><TD height="22">str3</TD><TD>str4</TD><TD>val1</TD><TD>oval1</TD></TR><TR><TD height="22">str3</TD><TD>str5</TD><TD>val2</TD><TD>oval2</TD></TR><TR><TD height="22">str3</TD><TD>str6</TD><TD>val3</TD><TD>oval3</TD></TR></TBODY></TABLE><P><BR />thank you.</P> Tue, 04 Aug 2020 00:51:20 GMT https://community.splunk.com/t5/Splunk-Search/how-to-join-the-two-tables/m-p/512242#M143660 youngrap 2020-08-04T00:51:20Z https://community.splunk.com/t5/Splunk-Search/how-to-join-the-two-tables/m-p/512254#M143663 <P>Assuming f1.csv contains the values of table A with field name f1 and tableb.csv contains the values of table b with field names C1, C2 and C3 the following does what you want</P><LI-CODE lang="markup">| inputlookup f1.csv | append [ | inputlookup tableb.csv | eval B=C1.",".C2.",".C3 | table B ] | eventstats values(B) as B | where !isnull(f1) | mvexpand B | rex field=B "(?&lt;C1&gt;[^,]*),(?&lt;C2&gt;[^,]*),(?&lt;C3&gt;.*)" | table f1, C1, C2, C3</LI-CODE><P>Hope this helps</P> Tue, 04 Aug 2020 03:21:36 GMT https://community.splunk.com/t5/Splunk-Search/how-to-join-the-two-tables/m-p/512254#M143663 bowesmana 2020-08-04T03:21:36Z https://community.splunk.com/t5/Splunk-Search/how-to-join-the-two-tables/m-p/512362#M143701 <P>Are you going to talk about Splunk? where is the field name?&nbsp;<BR /><BR />sample:<BR /><BR /></P><LI-CODE lang="markup">| makeresults | eval Atable=split("str1,str2,str3",",") | mvexpand Atable | append [|makeresults| eval _raw="str,val,oval str4,val1,oval1 str5,val2,oval2 str6,val3,oval3" | multikv forceheader=1 ] | eventstats list(Atable) as Atable | mvexpand Atable | where !isnull(linecount) | table Atable str val oval</LI-CODE><P>&nbsp;</P> Tue, 04 Aug 2020 12:32:57 GMT https://community.splunk.com/t5/Splunk-Search/how-to-join-the-two-tables/m-p/512362#M143701 to4kawa 2020-08-04T12:32:57Z https://community.splunk.com/t5/Splunk-Search/how-to-join-the-two-tables/m-p/512378#M143704 <P><SPAN>Thank you, I solved it:)</SPAN></P> Tue, 04 Aug 2020 13:22:09 GMT https://community.splunk.com/t5/Splunk-Search/how-to-join-the-two-tables/m-p/512378#M143704 youngrap 2020-08-04T13:22:09Z