Splunk Enterprise

Inner join on two hosts?

mobicotic
New Member

How do I make an "inner join" in Splunk for this SQL query?

SELECT column_name(s)
FROM table1
INNER JOIN table2
ON table1.id=table2.user_id;

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It goes something like this:

source=table1 | JOIN type=inner id [ SEARCH source=table2 | rename user_id AS id ] 

You might find this document helpful: Splunk for SQL users

---
If this reply helps you, Karma would be appreciated.

mobicotic
New Member

I'm new using Splunk.

Is "source" the same as a "host"?
Or how can I create tables?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Source and host are not the same. Source is the file containing the event (data) whereas host is the computer containing the source. You might want to check out the Splunk Tutorial (http://www.splunk.com/view/SP-CAAAH9U).
Splunk doesn't have "tables". It is not a database. Data is stored in indexes. Each entry in an index is an 'event'. Events typically contain a number of 'fields'. What constitutes a field depends on the type of event.
To create an index, go to Settings->Indexes and click the New Index button (you must be an admin to do this). Once you've created an index, you can then add data to it by selecting Settings->Add Data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mobicotic
New Member

Thank you. It worked. 🙂

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please accept the answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...