https://community.splunk.com/t5/Splunk-Search/Help-with-alert-search-with-join-or-append/m-p/632289#M219642 <P>This answer worked for me<BR /><BR /><A href="https://community.splunk.com/t5/Splunk-Search/Matching-fields-from-different-indices-to-return-another-field/m-p/470361" target="_blank">https://community.splunk.com/t5/Splunk-Search/Matching-fields-from-different-indices-to-return-another-field/m-p/470361</A></P> Sun, 26 Feb 2023 12:21:29 GMT VijaySrrie 2023-02-26T12:21:29Z https://community.splunk.com/t5/Splunk-Search/Help-with-alert-search-with-join-or-append/m-p/632286#M219640 <TABLE width="591"> <TBODY> <TR> <TD width="259">index=cat</TD> <TD width="64">&nbsp;</TD> <TD width="107">&nbsp;</TD> <TD width="64">&nbsp;</TD> <TD width="97">&nbsp;</TD> </TR> <TR> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> </TR> <TR> <TD>&nbsp;</TD> <TD>Name</TD> <TD>Place</TD> <TD>ID</TD> <TD>&nbsp;</TD> </TR> <TR> <TD>&nbsp;</TD> <TD>jack</TD> <TD>delhi</TD> <TD>1</TD> <TD>&nbsp;</TD> </TR> <TR> <TD>&nbsp;</TD> <TD>jill</TD> <TD>melbourne</TD> <TD>2</TD> <TD>&nbsp;</TD> </TR> <TR> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> </TR> <TR> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> </TR> <TR> <TD>index=dog</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> </TR> <TR> <TD>&nbsp;</TD> <TD>Country</TD> <TD>number</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> </TR> <TR> <TD>&nbsp;</TD> <TD>Australia</TD> <TD>2</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> </TR> <TR> <TD>&nbsp;</TD> <TD>India</TD> <TD>1</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> </TR> <TR> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> </TR> <TR> <TD>ID field in cat and number field in dog are same, I need below output</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> </TR> <TR> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> <TD>&nbsp;</TD> </TR> <TR> <TD>&nbsp;</TD> <TD>Name</TD> <TD>Place</TD> <TD>ID</TD> <TD>Country</TD> </TR> <TR> <TD>&nbsp;</TD> <TD>jack</TD> <TD>delhi</TD> <TD>1</TD> <TD>India</TD> </TR> <TR> <TD>&nbsp;</TD> <TD>jill</TD> <TD>melbourne</TD> <TD>2</TD> <TD>Australia</TD> </TR> </TBODY> </TABLE> Mon, 27 Feb 2023 14:38:36 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-alert-search-with-join-or-append/m-p/632286#M219640 VijaySrrie 2023-02-27T14:38:36Z https://community.splunk.com/t5/Splunk-Search/Help-with-alert-search-with-join-or-append/m-p/632288#M219641 <LI-CODE lang="markup">index=cat OR index=dog | rename number as ID | stats values(*) as * by ID</LI-CODE> Sun, 26 Feb 2023 12:21:25 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-alert-search-with-join-or-append/m-p/632288#M219641 ITWhisperer 2023-02-26T12:21:25Z https://community.splunk.com/t5/Splunk-Search/Help-with-alert-search-with-join-or-append/m-p/632289#M219642 <P>This answer worked for me<BR /><BR /><A href="https://community.splunk.com/t5/Splunk-Search/Matching-fields-from-different-indices-to-return-another-field/m-p/470361" target="_blank">https://community.splunk.com/t5/Splunk-Search/Matching-fields-from-different-indices-to-return-another-field/m-p/470361</A></P> Sun, 26 Feb 2023 12:21:29 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-alert-search-with-join-or-append/m-p/632289#M219642 VijaySrrie 2023-02-26T12:21:29Z https://community.splunk.com/t5/Splunk-Search/Help-with-alert-search-with-join-or-append/m-p/632291#M219643 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;,</P><P>Thanks for the reply, I have pasted the answer that worked for me.</P> Sun, 26 Feb 2023 12:22:51 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-alert-search-with-join-or-append/m-p/632291#M219643 VijaySrrie 2023-02-26T12:22:51Z