Splunk Search

Help needed with inner join with different field name and a filter

harryhcg
Explorer

Can someone help with query?


I have 2 index abc and bcz
From abc index I want to show stats for field1
where field2 from index abc matches with field3 of index bcz
and bcz index field5="value"

 

what I tried which is not working: 

index=abc

| stats count by field1

| join type=inner field2

[search index=bcz 
| rename field3 as field2

| where field5="employee_name"]

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index=abc [search index=bcz 
  | where field5="employee_name"
  | rename field3 as field2
  | fields field2]
| stats count by field1

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index=abc [search index=bcz 
  | where field5="employee_name"
  | rename field3 as field2
  | fields field2]
| stats count by field1
0 Karma

harryhcg
Explorer

@ITWhisperer  You are awesome, I was so stupid.
Thank you.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...