https://community.splunk.com/t5/Splunk-Search/self-join-in-splunk/m-p/97396#M25136 <P>Hi,</P> <P>Can you make me understand how to use a self join using splunk..</P> <P>A short example will work.</P> <P>thanks a lot !!</P> <P>Abhay</P> Sun, 21 Oct 2012 13:16:04 GMT abhayneilam 2012-10-21T13:16:04Z https://community.splunk.com/t5/Splunk-Search/self-join-in-splunk/m-p/97396#M25136 <P>Hi,</P> <P>Can you make me understand how to use a self join using splunk..</P> <P>A short example will work.</P> <P>thanks a lot !!</P> <P>Abhay</P> Sun, 21 Oct 2012 13:16:04 GMT https://community.splunk.com/t5/Splunk-Search/self-join-in-splunk/m-p/97396#M25136 abhayneilam 2012-10-21T13:16:04Z https://community.splunk.com/t5/Splunk-Search/self-join-in-splunk/m-p/97397#M25137 <P>Abhay,<BR /> ....| selfjoin [<OPTIONS>]* <FIELD-LIST> gives you a join on the selected field(s). The options are useful (overwrite, max or keepsingle. That allows control over values in the selected fields. Note the default on 'max' vs zero.<BR /> There's more at <A href="http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Selfjoin">http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Selfjoin</A></FIELD-LIST></OPTIONS></P> <P>The example used is ... | selfjoin id...which may start you off with results. Depends what you are trying to do after that <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Sun, 21 Oct 2012 14:05:24 GMT https://community.splunk.com/t5/Splunk-Search/self-join-in-splunk/m-p/97397#M25137 DaveSavage 2012-10-21T14:05:24Z