topic Re: Joining two searches in Splunk Search

Joining two searches

soumidutta — Sun, 28 Oct 2018 05:54:26 GMT

Hi ,

I want to join two searches without using Join command ?
I don't want to use join command for optimization issue.
Index name is same for both the searches but i was using different aggregate functions with the search .

Re: Joining two searches

renjith_nair — Sun, 28 Oct 2018 06:26:35 GMT

@soumidutta,

Would it be possible to provide more details ? Do you have a common field in both searches? Or how do you want to join them? How are the events look like and what's your expected output?

Re: Joining two searches

iamarkaprabha — Sun, 28 Oct 2018 06:28:57 GMT

Hi ,

You can use the same search for these optimization issue.
I prefer to write it like this.

index=indexname 
| stats dc(yourfield) count(eval(anotherfield=fieldvalue)) by other field names

Re: Joining two searches

soumidutta — Sun, 28 Oct 2018 06:33:45 GMT

Thanks, I was looking for this one

Re: Joining two searches

iamarkaprabha — Sun, 28 Oct 2018 06:35:09 GMT

Hi ,

If i am able to answer your query , Can you please mark this answer as accepted ?