topic Help me to format the below query without the join command. in Splunk Search

Help me to format the below query without the join command.

nivethainspire_ — Fri, 26 Mar 2021 10:09:29 GMT

Help me to format the below query without the join command.

the query is too slow for me and I have to run without join.

Re: Help me to format the below query without the join command.

aasabatini — Fri, 26 Mar 2021 11:08:39 GMT

please try to understand the logic on this search:

this is the best way to do a search without a join, Also you can use the where condition.

Regards

Alessandro

Re: Help me to format the below query without the join command.

nivethainspire_ — Fri, 26 Mar 2021 11:20:44 GMT

When I run this I get no result as the |search sev=Y has no data which is from 1st index and | search Legment="SOFT"| is from 2nd index

Both search together not working

Re: Help me to format the below query without the join command.

aasabatini — Fri, 26 Mar 2021 11:27:21 GMT

I don't know your data setI shared the search only to understand the logic.

index=sample OR index=sam sourcetype=Sample_1 OR sourcetype=sam_1 Legment="SOFT" OR sev=Y | makemv delim=";" AID
rename Name as AID |fillnull value="" Cos |stats count(VName) by AID