Getting Data In

How to merge data from 2 index with common field

kiranpatil1985
New Member

I have the following data in 2 different indexes that I want to merge based on the common email field.
Index B is a big dataset containing around 125k events. I tried using JOIN- but it has limitation and won't return desired results.

Index A

email         event
abc@xyz.com   click


Index B
email             field2 .  field3 .  field4 .  field5
abc@xyz.com       blah .    blah .    blah      blah

Final output should be

email    event . field2 .  field3 .  field4 .  field5
0 Karma

renjith_nair
Legend

@kiranpatil1985,

Try,

(index="A" OR index="B")|stats values(event) as event,values(field2) as field2,.....,values(fieldn) as fieldn by email
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...