Real time table load

anonuser · ‎11-04-2020

I have a table with a join, which means there are 2 sources - x and y. I receive the logs from x first, I would like to load the information from source x in the table even if source y is still empty and then, load the information that is missing from y once I received the logs. Is it possible to be done?

anonuser · ‎11-30-2020

I reached out the result I wanted by using join type=left

isoutamo · ‎11-04-2020

Hi

This is the way how splunk is working. Just ingest data from different sources and combine those together with searches.
r. Ismo

Real time table load

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Data Outage Monitoring and Reporting

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Join the Conversation

Real time table load

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Data Outage Monitoring and Reporting

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Persistent Queue at TcpOut — One of Splunk's Most Practical Features