Splunk Cloud Platform

How to combine two searches with common value into one table

alexandrebas
Explorer

I need help regarding a join from events based on two different indexes that are related by the same value in one specific field.

Below a simple example:

index=source1 | table device.hostname,device.serialnumber

Results:

device.hostnamedevice.serialnumber
host1ABC
host2DEF


index=source2 | table hostname,user

Results:

hostnameuser
host1john
host2mary


I would like to join these two searches in order to get the following results:

device.hostnamedevice.serialnumberuser
host1ABCjohn
host2DEFmary


Thank in advance for your help.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try with the name in single quotes

| eval hostname=coalesce(hostname,'device.hostname')

View solution in original post

0 Karma

alexandrebas
Explorer

It worked @ITWhisperer . 

Thank you very much.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=source1 OR index=source2
| eval hostname=coalesce(hostname,device.hostname)
| stats values(device.serialnumber) as serialnumber values(user) as user by hostname
0 Karma

alexandrebas
Explorer

Hi @ITWhisperer 

Thank you for your help. However, the field serialnumber wasn´t populated.  It seems the two searches weren´t merged.

Regards,

Alexandre

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try with the name in single quotes

| eval hostname=coalesce(hostname,'device.hostname')
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...