Real time table load

anonuser · ‎11-04-2020

I have a table with a join, which means there are 2 sources - x and y. I receive the logs from x first, I would like to load the information from source x in the table even if source y is still empty and then, load the information that is missing from y once I received the logs. Is it possible to be done?

anonuser · ‎11-30-2020

I reached out the result I wanted by using join type=left

isoutamo · ‎11-04-2020

Hi

This is the way how splunk is working. Just ingest data from different sources and combine those together with searches.
r. Ismo

Real time table load

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Data Management Digest – August 2026

Join the Conversation

Real time table load

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Data Management Digest – August 2026