How to connect two databases from different servers with join command?


Hello guys. I received this task at my job, and I still need money in my pocket, so please help me :)) 
I'm in a Network Operational team; maybe this will help you understand better the following description.

So, In a single Splunk search I have to connect 2 databases, from different servers

One DB contains "Incidents"Incident ID, Start time of the Incident (Let's call it A), End time of the incident (B)
The other DB contains  "Call Complaints"The timestamp of each Call complaint (C).

I need to find out the amount of call complaints for each incident. So, if C>=A AND C<=B, we count a call complaint for a specific incident, and we can move on to check the next C timestamp, and so on. 

I have issues right from the start. I tried to connect the databases with the next syntax:

| dbxquery query=[...]  connection=A
| join
              [ dbxquery  query=[...]  connection=B]

But, when I try a table command to see the interesting fields for me (Incident ID, A, B, C), the fields from the joined DB are looking the same on each line..Capture.PNG
Could you please help me with this? 

Labels (1)
0 Karma


Hi @razzeri,

Join command default type is  INNER which tries to match all possible fields. Can you try below?

Assuming connection A is your Incidents table.

| dbxquery query=[...]  connection=A
| join type=left max=0 INCIDENT_NUMBER
              [ dbxquery  query=[...]  connection=B]


If this reply helps you an upvote is appreciated.
0 Karma


I think I need a new "time" field to link with both DB. But how??

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...