Getting Data In

How do you append data from a different source in the same Index?

maheshsat
Explorer

I have one Index that has two different sources. One source has current data and another has historical data. Both have the same fields. I want to append data current in historical data incase there are any changes in current data by user that should be reflected in historical data. I want one side current data in column, & on the other side, there would be historical data in another column.

Trying below command

source="historical" PERIOD="Q1" YEAR="2012" | Table PERIOD, YEAR | append [index=prod source="current"  PERIOD="Q2" YEAR="2012" | Table PERIOD, YEAR]
Tags (1)
0 Karma
1 Solution

Akumar294
Path Finder

Please try like below:

index="your index" source="historical" PERIOD="Q1" YEAR="2012" 
|table PERIOD, YEAR 
|join [search index=prod source="current" PERIOD="Q2" YEAR="2012" 
|table PERIOD, YEAR]

View solution in original post

0 Karma

Akumar294
Path Finder

Please try like below:

index="your index" source="historical" PERIOD="Q1" YEAR="2012" 
|table PERIOD, YEAR 
|join [search index=prod source="current" PERIOD="Q2" YEAR="2012" 
|table PERIOD, YEAR]
0 Karma

Akumar294
Path Finder

If above solution resolved your problem, can you please accept the answer?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...