Real time table load

anonuser · ‎11-04-2020

I have a table with a join, which means there are 2 sources - x and y. I receive the logs from x first, I would like to load the information from source x in the table even if source y is still empty and then, load the information that is missing from y once I received the logs. Is it possible to be done?

anonuser · ‎11-30-2020

I reached out the result I wanted by using join type=left

isoutamo · ‎11-04-2020

Hi

This is the way how splunk is working. Just ingest data from different sources and combine those together with searches.
r. Ismo

Real time table load

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation

Real time table load

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas