Splunk Search

Help needed with inner join with different field name and a filter

harryhcg
Explorer

Can someone help with query?


I have 2 index abc and bcz
From abc index I want to show stats for field1
where field2 from index abc matches with field3 of index bcz
and bcz index field5="value"

 

what I tried which is not working: 

index=abc

| stats count by field1

| join type=inner field2

[search index=bcz 
| rename field3 as field2

| where field5="employee_name"]

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index=abc [search index=bcz 
  | where field5="employee_name"
  | rename field3 as field2
  | fields field2]
| stats count by field1

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index=abc [search index=bcz 
  | where field5="employee_name"
  | rename field3 as field2
  | fields field2]
| stats count by field1
0 Karma

harryhcg
Explorer

@ITWhisperer  You are awesome, I was so stupid.
Thank you.

0 Karma
Get Updates on the Splunk Community!

Manual Instrumentation with Splunk Observability Cloud: The What and Why

If you've ever worked with distributed systems, you’ve likely felt the pain of a frontend throwing errors, ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...