Is there a way to make tables in a dashboard work together using two different sources?

[Ragate]

On my spunk dashboard I am showing tables with two different sources. Is there a way to have the tables sync up with the different data?
For example: If I have a License Key that appears in one table that matches the License Key (from a different source) in the other table, can it show the Documents Processed from this?

Do I need to create a search to merge these sources together or can I just do it through the dashboard?

Thanks in advance.

[richgalloway · Accepted solution]

Yes, you must write an SPL query to combine the two searches. The dashboard will not do it for you.
Like @kiamco suggests, you can use join to combine them, but that is usually the least efficient way. Often, stats can used instead of join. See http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Join

[Ragate]

I have tried using a join and this is what I came up:
source="C:\Users\ragate\Desktop\splunk\LMCustomerRevLicense.csv" | join type=left substr('context.custom.dimensions{}.LicenseKey' ,4,7) [search source="c:\users\ragate\desktop\splunk\jsondump.txt"] | eval LicenseKeyID=substr('context.custom.dimensions{}.LicenseKey' ,4,7) | where 'LicenseKeyID'='License Key Identifier'

This only brings but one event in each field when there should be about 20 more there. Not sure where I went wrong. Also have been told that stats would work but I am not sure how to use that to do what I want.

[richgalloway]

The first argument to join after type=left should be a field name, not an expression.

source="C:\\Users\\ragate\\Desktop\\splunk\\LMCustomerRevLicense.csv" | eval LicenseKeyID=substr('context.custom.dimensions{}.LicenseKey' ,4,7) | join type=left LicenseKeyID  [search source="c:\\users\\ragate\\desktop\\splunk\\jsondump.txt" | eval LicenseKeyID=substr('context.custom.dimensions{}.LicenseKey' ,4,7)] 

[Ragate]

Thank you!

[kiamco]

Try using the join command

eg:
your first search..
|join "License key" [|search second search]