Getting Data In

Matching a timestamp from two index events.


Hi guys,

I have two indexes with two different types of syslogs. Both logs contain a common field (username) and I would like to be able to pair them up to form a single event/result.

Could someone please advise the best way to approach this task? I assume I would need to form a common field between the two event types but how would I then display the common field alongside independent fields from both indexes?

I hope that makes sense, struggled to explain that one!

Thank you!

0 Karma


Greetings @danfinan,

The efficient way to do this is to use stats. Here's some sample data:


username    field1
User1        abc
User2        def
User3        ghi
User4        -
User5        -


username    field2
User1        xyz
User2        nop
User3        -
User4        klm
User5        -

Here's a run-anywhere search that will transform as you described:

           | makeresults | eval username="User1", field1="abc"
| append [ | makeresults | eval username="User1", field2="xyz" ]
| append [ | makeresults | eval username="User2", field1="def" ]
| append [ | makeresults | eval username="User2", field2="nop" ]
| append [ | makeresults | eval username="User3", field1="ghi" ]
| append [ | makeresults | eval username="User4", field2="klm" ]
| append [ | makeresults | eval username="User5" ]
| stats values(field1) as field1 values(field2) as field2 by username

And the output will look like this:

username    field1   field2
User1        abc      xyz
User2        def      nop
User3        ghi      -
User4        -        klm
User5        -        -



If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...