https://community.splunk.com/t5/Splunk-Search/subsearch-for-multiple-indexes/m-p/152825#M42828 <P>If name is the common field in both indexes, you can use below to get all attributes for a name from two indexes.</P> <PRE><CODE>index=indexA | table name,..other fields from indexA... | join name [search index=indexB | table name,..other fields from indexB...] </CODE></PRE> Fri, 22 Nov 2013 18:47:58 GMT somesoni2 2013-11-22T18:47:58Z https://community.splunk.com/t5/Splunk-Search/subsearch-for-multiple-indexes/m-p/152824#M42827 <P>Hi All</P> <P>I have 2 indexes. 1st indexes contains list of names. i have to pass each name as input to second index and calculate values for each name.</P> <P>We can use two quires to get each name and pass to 2nd index. But i need them in single query. expecting output fields from 1st index as well as calculated fields from the 2nd index.. ????? </P> Fri, 22 Nov 2013 18:44:37 GMT https://community.splunk.com/t5/Splunk-Search/subsearch-for-multiple-indexes/m-p/152824#M42827 anudeep247 2013-11-22T18:44:37Z https://community.splunk.com/t5/Splunk-Search/subsearch-for-multiple-indexes/m-p/152825#M42828 <P>If name is the common field in both indexes, you can use below to get all attributes for a name from two indexes.</P> <PRE><CODE>index=indexA | table name,..other fields from indexA... | join name [search index=indexB | table name,..other fields from indexB...] </CODE></PRE> Fri, 22 Nov 2013 18:47:58 GMT https://community.splunk.com/t5/Splunk-Search/subsearch-for-multiple-indexes/m-p/152825#M42828 somesoni2 2013-11-22T18:47:58Z https://community.splunk.com/t5/Splunk-Search/subsearch-for-multiple-indexes/m-p/152826#M42829 <P>Thank you somesoni2,<BR /> Here name is common for both indexes and i also have 2nd fields with different name. will this work??</P> Fri, 22 Nov 2013 19:00:46 GMT https://community.splunk.com/t5/Splunk-Search/subsearch-for-multiple-indexes/m-p/152826#M42829 anudeep247 2013-11-22T19:00:46Z https://community.splunk.com/t5/Splunk-Search/subsearch-for-multiple-indexes/m-p/152827#M42830 <P>I believe so. Let me know if there are any issues.</P> Fri, 22 Nov 2013 19:44:37 GMT https://community.splunk.com/t5/Splunk-Search/subsearch-for-multiple-indexes/m-p/152827#M42830 somesoni2 2013-11-22T19:44:37Z