Splunk Cloud Platform

How to combine two searches with common value into one table

alexandrebas
Explorer

I need help regarding a join from events based on two different indexes that are related by the same value in one specific field.

Below a simple example:

index=source1 | table device.hostname,device.serialnumber

Results:

device.hostnamedevice.serialnumber
host1ABC
host2DEF


index=source2 | table hostname,user

Results:

hostnameuser
host1john
host2mary


I would like to join these two searches in order to get the following results:

device.hostnamedevice.serialnumberuser
host1ABCjohn
host2DEFmary


Thank in advance for your help.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try with the name in single quotes

| eval hostname=coalesce(hostname,'device.hostname')

View solution in original post

0 Karma

alexandrebas
Explorer

It worked @ITWhisperer . 

Thank you very much.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=source1 OR index=source2
| eval hostname=coalesce(hostname,device.hostname)
| stats values(device.serialnumber) as serialnumber values(user) as user by hostname
0 Karma

alexandrebas
Explorer

Hi @ITWhisperer 

Thank you for your help. However, the field serialnumber wasn´t populated.  It seems the two searches weren´t merged.

Regards,

Alexandre

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try with the name in single quotes

| eval hostname=coalesce(hostname,'device.hostname')
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...