https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130149#M35422 <P>And I found a mistake - there is "AccountName*<EM>!</EM><EM>="</EM>$""</P> <PRE><CODE>source="WinEventLog:Security" EventCode=4624 AccountName!="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [ search index=anotherindex employeeID=* ] | table _time, user, employeeID </CODE></PRE> Mon, 28 Sep 2020 18:14:26 GMT r2r2 2020-09-28T18:14:26Z https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130146#M35419 <P>Hello!<BR /> I am trying to make a dashboard with fields from 2 indexes using the command "join".<BR /> I wrote a search <CODE>source="WinEventLog:Security" EventCode=4624 AccountName!="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [index=anotherindex employeeID=*] | table _time, user, employeeID</CODE></P> <P>But column employeeID is empty. What did I do wrong?</P> Mon, 24 Nov 2014 12:02:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130146#M35419 r2r2 2014-11-24T12:02:14Z https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130147#M35420 <P>Use this one</P> <P><CODE>source="WinEventLog:Security" EventCode=4624 AccountName="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [</CODE><STRONG>search</STRONG> <CODE>index=anotherindex employeeID=* ] | table _time, user, employeeID</CODE></P> Mon, 24 Nov 2014 12:30:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130147#M35420 jitsinha 2014-11-24T12:30:16Z https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130148#M35421 <P>I added "search" but column "employeeID" is still empty.</P> Mon, 24 Nov 2014 13:06:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130148#M35421 r2r2 2014-11-24T13:06:26Z https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130149#M35422 <P>And I found a mistake - there is "AccountName*<EM>!</EM><EM>="</EM>$""</P> <PRE><CODE>source="WinEventLog:Security" EventCode=4624 AccountName!="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [ search index=anotherindex employeeID=* ] | table _time, user, employeeID </CODE></PRE> Mon, 28 Sep 2020 18:14:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130149#M35422 r2r2 2020-09-28T18:14:26Z https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130150#M35423 <P>glad it resolved your issue</P> Mon, 24 Nov 2014 13:12:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130150#M35423 jitsinha 2014-11-24T13:12:37Z https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130151#M35424 <P>chersss!!!</P> Mon, 24 Nov 2014 13:13:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130151#M35424 jitsinha 2014-11-24T13:13:15Z https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130152#M35425 <P>I found one more mistake in this search and now it works properly.<BR /> Your answer resolved my issue. Thank you!</P> Mon, 24 Nov 2014 13:19:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Join-fields-from-2-indexes/m-p/130152#M35425 r2r2 2014-11-24T13:19:23Z