Splunk Cloud Platform

How to combine two searches with common value into one table

alexandrebas
Explorer

I need help regarding a join from events based on two different indexes that are related by the same value in one specific field.

Below a simple example:

index=source1 | table device.hostname,device.serialnumber

Results:

device.hostnamedevice.serialnumber
host1ABC
host2DEF


index=source2 | table hostname,user

Results:

hostnameuser
host1john
host2mary


I would like to join these two searches in order to get the following results:

device.hostnamedevice.serialnumberuser
host1ABCjohn
host2DEFmary


Thank in advance for your help.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try with the name in single quotes

| eval hostname=coalesce(hostname,'device.hostname')

View solution in original post

0 Karma

alexandrebas
Explorer

It worked @ITWhisperer . 

Thank you very much.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=source1 OR index=source2
| eval hostname=coalesce(hostname,device.hostname)
| stats values(device.serialnumber) as serialnumber values(user) as user by hostname
0 Karma

alexandrebas
Explorer

Hi @ITWhisperer 

Thank you for your help. However, the field serialnumber wasn´t populated.  It seems the two searches weren´t merged.

Regards,

Alexandre

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try with the name in single quotes

| eval hostname=coalesce(hostname,'device.hostname')
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...