Getting Data In

Real time table load

anonuser
Explorer

I have a table with a join, which means there are 2 sources - x and y.  I receive the logs from x first, I would like to load the information from source x  in the table even if source y is still empty and then, load the information that is missing from y once I received the logs. Is it possible to be done?

Labels (1)
0 Karma

anonuser
Explorer

I reached out the result I wanted by using join type=left

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

This is the way how splunk is working. Just ingest data from different sources and combine those together with searches.
r. Ismo

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...