<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: how to combine data based on a common field in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/601556#M209356</link>
    <description>&lt;P&gt;I don't want to just display the data directly using stats. My raw data has alot of processing to do and using join i am joining all these processed results. Is there any solution other than this?&lt;/P&gt;</description>
    <pubDate>Mon, 13 Jun 2022 13:49:38 GMT</pubDate>
    <dc:creator>anooshac</dc:creator>
    <dc:date>2022-06-13T13:49:38Z</dc:date>
    <item>
      <title>How to combine data based on a common field?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/601534#M209348</link>
      <description>&lt;P&gt;Hi all, i have some data task name, execution date, link uploaded earlier. Now i want to add some more data related to the task name they are component name, number of components. If i upload the 2nd data in the form task name , component name, number of components will i be able to get all data together based on one common field task name. Can anyone knows is there any solution for this?&lt;/P&gt;
&lt;P&gt;My data are task name, execution date, link and the next set of data&amp;nbsp; is task name , component name, number of components.&lt;/P&gt;</description>
      <pubDate>Mon, 13 Jun 2022 20:14:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/601534#M209348</guid>
      <dc:creator>anooshac</dc:creator>
      <dc:date>2022-06-13T20:14:37Z</dc:date>
    </item>
    <item>
      <title>Re: how to combine data based on a common field</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/601539#M209350</link>
      <description>&lt;P&gt;Yes, you can either use join or stats by task name to aggregate the values from the fields on a common take name.&lt;/P&gt;</description>
      <pubDate>Mon, 13 Jun 2022 12:53:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/601539#M209350</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2022-06-13T12:53:16Z</dc:date>
    </item>
    <item>
      <title>Re: how to combine data based on a common field</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/601556#M209356</link>
      <description>&lt;P&gt;I don't want to just display the data directly using stats. My raw data has alot of processing to do and using join i am joining all these processed results. Is there any solution other than this?&lt;/P&gt;</description>
      <pubDate>Mon, 13 Jun 2022 13:49:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/601556#M209356</guid>
      <dc:creator>anooshac</dc:creator>
      <dc:date>2022-06-13T13:49:38Z</dc:date>
    </item>
    <item>
      <title>Re: how to combine data based on a common field</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/601562#M209360</link>
      <description>&lt;P&gt;Stats, just like any command, works on the events in the pipeline; you can choose where you put the stats command; you can have more than one stats command if that helps your use case.&lt;/P&gt;</description>
      <pubDate>Mon, 13 Jun 2022 14:09:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/601562#M209360</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2022-06-13T14:09:18Z</dc:date>
    </item>
    <item>
      <title>Re: how to combine data based on a common field</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/601697#M209414</link>
      <description>&lt;P&gt;when i use stats all the data including the data i don't want to display also shows. How to avoid these? I tried by putting table command after stats for the selected data but that doesn't work.&lt;/P&gt;</description>
      <pubDate>Tue, 14 Jun 2022 09:57:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/601697#M209414</guid>
      <dc:creator>anooshac</dc:creator>
      <dc:date>2022-06-14T09:57:42Z</dc:date>
    </item>
    <item>
      <title>Re: how to combine data based on a common field</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/601699#M209415</link>
      <description>&lt;P&gt;The table command can be used to limit the fields/columns - the where command can be used to limit the event/rows&lt;/P&gt;</description>
      <pubDate>Tue, 14 Jun 2022 10:01:30 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/601699#M209415</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2022-06-14T10:01:30Z</dc:date>
    </item>
    <item>
      <title>Re: how to combine data based on a common field</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/602227#M209624</link>
      <description>&lt;P&gt;Okay. Thank you so much.&lt;/P&gt;</description>
      <pubDate>Fri, 17 Jun 2022 11:08:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-combine-data-based-on-a-common-field/m-p/602227#M209624</guid>
      <dc:creator>anooshac</dc:creator>
      <dc:date>2022-06-17T11:08:00Z</dc:date>
    </item>
  </channel>
</rss>

