All Apps and Add-ons

Join 2 query based on common column

priya0709
Path Finder

How can i join two query table based on common column ( host), but i want to display all columns from 1st table but just 1 column ( Incident column) from 2nd table??

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

query 1
| join Host [ query2]
| table Host, Time, Eventcode, Message, Incident

this is too slow , but it will work.

View solution in original post

to4kawa
Ultra Champion

What's the two queries and logs?

0 Karma

priya0709
Path Finder

Query 1 displays ( Host, Time, Eventcode, Message) 

Query 2 displays ( subject, Host, Incident)

i want to all match hosts in both column and based on that join the querys to display ( Host, Time, Eventcode, Message, incident)

0 Karma

to4kawa
Ultra Champion

query 1
| join Host [ query2]
| table Host, Time, Eventcode, Message, Incident

this is too slow , but it will work.

priya0709
Path Finder

This worked but it is not displaying Host from query 1 even if it doesnt find any host in query 2??

my requirment is to match host but also display all output fro. Query 1??

0 Karma

to4kawa
Ultra Champion



please modify join option.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...