Splunk Enterprise Security

Join two indexes without any unique field


I have two indexes that I need to join to get data from both of them, unfortunately there are no common values on both indexes. Is there a way to join these indexes together?

0 Karma


Hi @charlesukah22,
you can take logs from two indexes simply using both of them in the main search with OR operator:

index=indexA OR index=indexB
| ...

The problem is how to use these events if it isn't possible to correlate them and what to display.
At least you have to find something common between then and create a correlation using tags and eventtypes:
e.g. if you want the logfail events of two different systems, you could create two eventtypes:
windows_logfail index=wineventlog EventCode=4625
splunk_logfail index=_internal sourcetype=splunkd "login failed"
assign to both of them the same tag (e.g. LOGFAIL) (beware is case sensitive.
then create a search that displays logfails from both the indexes:

| rex "user:\s+(?<user>[^ ]+)"
| eval kind=case(index="wineventlog","Windows", index="_internal","Splunk")
| table _time user kind

If you could share more infos I'd be more detailed.


0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...