All Apps and Add-ons

Join 2 query based on common column

priya0709
Path Finder

How can i join two query table based on common column ( host), but i want to display all columns from 1st table but just 1 column ( Incident column) from 2nd table??

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

query 1
| join Host [ query2]
| table Host, Time, Eventcode, Message, Incident

this is too slow , but it will work.

View solution in original post

to4kawa
Ultra Champion

What's the two queries and logs?

0 Karma

priya0709
Path Finder

Query 1 displays ( Host, Time, Eventcode, Message) 

Query 2 displays ( subject, Host, Incident)

i want to all match hosts in both column and based on that join the querys to display ( Host, Time, Eventcode, Message, incident)

0 Karma

to4kawa
Ultra Champion

query 1
| join Host [ query2]
| table Host, Time, Eventcode, Message, Incident

this is too slow , but it will work.

priya0709
Path Finder

This worked but it is not displaying Host from query 1 even if it doesnt find any host in query 2??

my requirment is to match host but also display all output fro. Query 1??

0 Karma

to4kawa
Ultra Champion



please modify join option.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...