Splunk Cloud Platform

How to combine two searches with common value into one table

alexandrebas
Explorer

I need help regarding a join from events based on two different indexes that are related by the same value in one specific field.

Below a simple example:

index=source1 | table device.hostname,device.serialnumber

Results:

device.hostnamedevice.serialnumber
host1ABC
host2DEF


index=source2 | table hostname,user

Results:

hostnameuser
host1john
host2mary


I would like to join these two searches in order to get the following results:

device.hostnamedevice.serialnumberuser
host1ABCjohn
host2DEFmary


Thank in advance for your help.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try with the name in single quotes

| eval hostname=coalesce(hostname,'device.hostname')

View solution in original post

0 Karma

alexandrebas
Explorer

It worked @ITWhisperer . 

Thank you very much.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=source1 OR index=source2
| eval hostname=coalesce(hostname,device.hostname)
| stats values(device.serialnumber) as serialnumber values(user) as user by hostname
0 Karma

alexandrebas
Explorer

Hi @ITWhisperer 

Thank you for your help. However, the field serialnumber wasn´t populated.  It seems the two searches weren´t merged.

Regards,

Alexandre

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try with the name in single quotes

| eval hostname=coalesce(hostname,'device.hostname')
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...