Splunk Enterprise

How to combine two different events from different indexes/sourcetypes?

mikepangrac
Loves-to-Learn Lots

Hello, I'm trying to combine different events (with different fields) into one event based on a common field value.  Is there an easy way to do this?  For example:

(index=data sourcetype=source1) OR (index=customer sourcetype=sourcetype2)

Event from Source 1:
customer#: 12345
billingpackage: fastspeed
speed: 50m

Event from Source 2:
customer#: 12345
address: 1st street noth
zip: 41783

Desired Event:
customer#: 12345
billingpackage: fastspeed
speed: 50m
address: 1st street north
zip: 41783

Thanks in advance for the help!

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You were close.  Run the query you have then use the stats command to merge the results.

(index=data sourcetype=source1) OR (index=customer sourcetype=sourcetype2)
| stats values(*) as * by customer

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...