Real time table load

anonuser · ‎11-04-2020

I have a table with a join, which means there are 2 sources - x and y. I receive the logs from x first, I would like to load the information from source x in the table even if source y is still empty and then, load the information that is missing from y once I received the logs. Is it possible to be done?

anonuser · ‎11-30-2020

I reached out the result I wanted by using join type=left

isoutamo · ‎11-04-2020

Hi

This is the way how splunk is working. Just ingest data from different sources and combine those together with searches.
r. Ismo

Real time table load

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Real time table load

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...