topic Re: How to join two searches based on two different formatted fields in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-join-two-searches-based-on-two-different-formatted-fields/m-p/392855#M171970 <P>hi @sangs8788 </P> <PRE><CODE>index=index1 TXN_ID ="24,25" | makemv delim="," TXN_ID |mvexpand TXN_ID|rename TXN_ID as ID |join ID [search index=index2 ID=25 ] </CODE></PRE> Mon, 08 Apr 2019 10:45:21 GMT harishalipaka 2019-04-08T10:45:21Z How to join two searches based on two different formatted fields https://community.splunk.com/t5/Splunk-Search/How-to-join-two-searches-based-on-two-different-formatted-fields/m-p/392853#M171968 <P>I have an index which contains field - TXN_ID = "24, 25 "<BR /> index=index1 TXN_ID ="24,25"</P> <P>I have another event in different index which has field - ID = 25<BR /> index=index2 ID=25</P> <P>How do i combine both these two queries to get the other details from Index1 ? I know we have to use join. But since the index1 field value contains comma separated value, i am not very sure on how to form the query. Can someone help me on this.</P> Tue, 29 Sep 2020 23:58:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-two-searches-based-on-two-different-formatted-fields/m-p/392853#M171968 sangs8788 2020-09-29T23:58:42Z Re: How to join two searches based on two different formatted fields https://community.splunk.com/t5/Splunk-Search/How-to-join-two-searches-based-on-two-different-formatted-fields/m-p/392854#M171969 <P>Try this:</P> <PRE><CODE>index=index1 TXN_ID ="24,25" | eval ID = split(TXN_ID,",") | mvexpand ID | join ID [ search index=index2 ID=25 ] </CODE></PRE> <P><STRONG>Sample:</STRONG></P> <PRE><CODE>| makeresults | eval TXN_ID ="24,25" | eval ID = split(TXN_ID,",") | mvexpand ID | join ID [ | makeresults | eval ID = 24 | table _time ID] </CODE></PRE> Mon, 08 Apr 2019 10:36:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-two-searches-based-on-two-different-formatted-fields/m-p/392854#M171969 kamlesh_vaghela 2019-04-08T10:36:30Z Re: How to join two searches based on two different formatted fields https://community.splunk.com/t5/Splunk-Search/How-to-join-two-searches-based-on-two-different-formatted-fields/m-p/392855#M171970 <P>hi @sangs8788 </P> <PRE><CODE>index=index1 TXN_ID ="24,25" | makemv delim="," TXN_ID |mvexpand TXN_ID|rename TXN_ID as ID |join ID [search index=index2 ID=25 ] </CODE></PRE> Mon, 08 Apr 2019 10:45:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-two-searches-based-on-two-different-formatted-fields/m-p/392855#M171970 harishalipaka 2019-04-08T10:45:21Z