topic Re: How do I combine data from two different sources without the append or the union command? in Splunk Search

How do I combine data from two different sources without the append or the union command?

atozeswar — Wed, 05 Dec 2018 09:36:05 GMT

Hi,

is there any way to combine data from two different sources without the append or the union command?

I have a code like this..

Index=csvl source="file1. Csv" or source="file2. Csv" |

First searching from some data from first source file1.csv
Next searching from some data from 2nd source file2.csv

At least I'm using append to combine both results. Is there any way to remove append or union from the query..?

Thank you..

Re: How do I combine data from two different sources without the append or the union command?

kmorris_splunk — Wed, 05 Dec 2018 15:04:20 GMT

Can you provide a little more detail on what you would like as the end result?

Re: How do I combine data from two different sources without the append or the union command?

bjoernjensen — Wed, 05 Dec 2018 16:48:37 GMT

Hey,

that depends on your data. Does file1 and file2 have totally distinct columns?

If you want them to be combined you need some kind of "key" to match them. Or to be more specific: You need a "rule" which tells you a mapping of rows of file1 to rows of file2. And this mapping has to be a 1-to-1 relation, usually induced by a key value. This could be _time, could be a combination of values within each file.

If _time can be used as your key, you might work with bin _time span=1m and continue with stats latest(value) (keep in mind you are aggregating here and might "loose" a value using latest. Test this by using list()).

Hope that helps,
Björn

Re: How do I combine data from two different sources without the append or the union command?

atozeswar — Thu, 06 Dec 2018 01:38:26 GMT

Some rows of data from file1 and some rows of data from files2. I need to append both and make a table but without using append..

Re: How do I combine data from two different sources without the append or the union command?

sdchakraborty — Thu, 06 Dec 2018 05:55:22 GMT

Hi,
If you have matching fields in both the data sets you can use "join" command. like,

[data_set1]
| join type = inner/left
[data set 2]

Sid

Re: How do I combine data from two different sources without the append or the union command?

martin_mueller — Thu, 06 Dec 2018 15:31:26 GMT

https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html