Getting Data In

How to merge data from 2 index with common field

kiranpatil1985
New Member

I have the following data in 2 different indexes that I want to merge based on the common email field.
Index B is a big dataset containing around 125k events. I tried using JOIN- but it has limitation and won't return desired results.

Index A

email         event
abc@xyz.com   click


Index B
email             field2 .  field3 .  field4 .  field5
abc@xyz.com       blah .    blah .    blah      blah

Final output should be

email    event . field2 .  field3 .  field4 .  field5
0 Karma

renjith_nair
Legend

@kiranpatil1985,

Try,

(index="A" OR index="B")|stats values(event) as event,values(field2) as field2,.....,values(fieldn) as fieldn by email
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...