Splunk Enterprise

Inner join on two hosts?

mobicotic
New Member

How do I make an "inner join" in Splunk for this SQL query?

SELECT column_name(s)
FROM table1
INNER JOIN table2
ON table1.id=table2.user_id;

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It goes something like this:

source=table1 | JOIN type=inner id [ SEARCH source=table2 | rename user_id AS id ] 

You might find this document helpful: Splunk for SQL users

---
If this reply helps you, Karma would be appreciated.

mobicotic
New Member

I'm new using Splunk.

Is "source" the same as a "host"?
Or how can I create tables?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Source and host are not the same. Source is the file containing the event (data) whereas host is the computer containing the source. You might want to check out the Splunk Tutorial (http://www.splunk.com/view/SP-CAAAH9U).
Splunk doesn't have "tables". It is not a database. Data is stored in indexes. Each entry in an index is an 'event'. Events typically contain a number of 'fields'. What constitutes a field depends on the type of event.
To create an index, go to Settings->Indexes and click the New Index button (you must be an admin to do this). Once you've created an index, you can then add data to it by selecting Settings->Add Data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mobicotic
New Member

Thank you. It worked. 🙂

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please accept the answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...