- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
harryhcg
Explorer
01-24-2023
10:59 AM
Can someone help with query?
I have 2 index abc and bcz
From abc index I want to show stats for field1
where field2 from index abc matches with field3 of index bcz
and bcz index field5="value"
what I tried which is not working:
index=abc
| stats count by field1
| join type=inner field2
[search index=bcz
| rename field3 as field2
| where field5="employee_name"]
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
01-24-2023
11:31 AM
Try something like this
index=abc [search index=bcz
| where field5="employee_name"
| rename field3 as field2
| fields field2]
| stats count by field1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
01-24-2023
11:31 AM
Try something like this
index=abc [search index=bcz
| where field5="employee_name"
| rename field3 as field2
| fields field2]
| stats count by field1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
harryhcg
Explorer
01-24-2023
11:50 AM
@ITWhisperer You are awesome, I was so stupid.
Thank you.
