Splunk Dev

How do i use join in a query where i have used data from 2 data models?

rohitnaz007
Loves-to-Learn Lots

I am using search query from indexes using join operator and get result as below ,

Search Query =

index=case_management AND cef_name="Case inserted"
| where fname LIKE "%%CMI - IPS%%"
| dedup fileId
| join fname
[ search index=case_management AND cef_name="Case updated" ]
| rex field=fname "CMI - IPS - \((?<customer_id>[\d]+)\) - CMI (?<Env>[^\s]+) - "
| where Env ="Prod"
| timechart span=1mon count by flexString2 fixedrange=false cont=false
| where _time>=relative_time(now(),"-3mon@mon") AND _time<relative_time(now(),"-0mon@mon")

 

Result is=

_time       Closed Follow-Up Queued
2020-09   113             4                   1
2020-10   26                0                   0


i want to get the same result by writing a query using data model. 

@elrich11 

Labels (1)
0 Karma

rohitnaz007
Loves-to-Learn Lots

can anyone help in this scenario, this is an urgent issue for me!

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...