Splunk Search

Help with alert search with join or append?

VijaySrrie
Builder
index=cat        
         
  Name Place ID  
  jack delhi 1  
  jill melbourne 2  
         
         
index=dog        
  Country number    
  Australia 2    
  India 1    
         
ID field in cat and number field in dog are same, I need below output    
         
  Name Place ID Country
  jack delhi 1 India
  jill melbourne 2 Australia
Labels (2)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=cat OR index=dog
| rename number as ID
| stats values(*) as * by ID
0 Karma

VijaySrrie
Builder

Hi @ITWhisperer ,

Thanks for the reply, I have pasted the answer that worked for me.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...