Getting Data In

How to merge data from 2 index with common field

kiranpatil1985
New Member

I have the following data in 2 different indexes that I want to merge based on the common email field.
Index B is a big dataset containing around 125k events. I tried using JOIN- but it has limitation and won't return desired results.

Index A

email         event
abc@xyz.com   click


Index B
email             field2 .  field3 .  field4 .  field5
abc@xyz.com       blah .    blah .    blah      blah

Final output should be

email    event . field2 .  field3 .  field4 .  field5
0 Karma

renjith_nair
Legend

@kiranpatil1985,

Try,

(index="A" OR index="B")|stats values(event) as event,values(field2) as field2,.....,values(fieldn) as fieldn by email
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...