https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-tables-to-get-result-in-one-table/m-p/670804#M229920 <P>What else I can do to get the correlationId in one table as this query is comparing and giving the common results.</P> <LI-CODE lang="markup">(sourcetype=bmw-crm-wh-sl-sfdc-subscribe-pe-int-api ("Received platform event for CUSTOMER")) | table properties.correlationId | join left=L right=R type=inner where L.properties.correlationId=R.properties.correlationId [search sourcetype=bmw-pl-customer-int-api ("recipient : *.ESOCRM") | table properties.correlationId]</LI-CODE> <P class=""><BR /><BR />And can I again you join in this query.</P> Tue, 05 Dec 2023 13:06:13 GMT avi7326 2023-12-05T13:06:13Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-tables-to-get-result-in-one-table/m-p/670796#M229917 <P>How to get a single table from this query having all the correlationId together in one table</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="avi7326_0-1701776034776.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/28373i50A2D6223C0B2592/image-size/medium?v=v2&amp;px=400" role="button" title="avi7326_0-1701776034776.png" alt="avi7326_0-1701776034776.png" /></span></P><P>&nbsp;</P> Tue, 05 Dec 2023 11:34:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-tables-to-get-result-in-one-table/m-p/670796#M229917 avi7326 2023-12-05T11:34:33Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-tables-to-get-result-in-one-table/m-p/670801#M229919 <P>Your join has already created a single table. However, you might want to consider including both sourcetypes and filters in the same initial search, then collate the events with a stats command.</P> Tue, 05 Dec 2023 11:47:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-tables-to-get-result-in-one-table/m-p/670801#M229919 ITWhisperer 2023-12-05T11:47:21Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-tables-to-get-result-in-one-table/m-p/670804#M229920 <P>What else I can do to get the correlationId in one table as this query is comparing and giving the common results.</P> <LI-CODE lang="markup">(sourcetype=bmw-crm-wh-sl-sfdc-subscribe-pe-int-api ("Received platform event for CUSTOMER")) | table properties.correlationId | join left=L right=R type=inner where L.properties.correlationId=R.properties.correlationId [search sourcetype=bmw-pl-customer-int-api ("recipient : *.ESOCRM") | table properties.correlationId]</LI-CODE> <P class=""><BR /><BR />And can I again you join in this query.</P> Tue, 05 Dec 2023 13:06:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-tables-to-get-result-in-one-table/m-p/670804#M229920 avi7326 2023-12-05T13:06:13Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-tables-to-get-result-in-one-table/m-p/670805#M229921 <LI-CODE lang="markup">(sourcetype=bmw-crm-wh-sl-sfdc-subscribe-pe-int-api ("Received platform event for CUSTOMER")) OR (sourcetype=bmw-pl-customer-int-api ("recipient : *.ESOCRM")) | stats values by properties.correlationId</LI-CODE> Tue, 05 Dec 2023 12:06:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-tables-to-get-result-in-one-table/m-p/670805#M229921 ITWhisperer 2023-12-05T12:06:31Z