Splunk Search

How can I join two searches on a common field?

alanzchan
Path Finder

I'm trying to append a two tables on a common key. I am using |appendcols but the two tables are not internally joined, just placed side by side. Am I correct to use |appendcols?

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

appendcols is rarely useful, IMO. As you've discovered, it combines events without regard for the value of any field.

Depending on the nature of your data and what you want to do with the results, you should consider the stats or join command. The former is more efficient, but can be tricky to get the right results.

If you post some sample events or queries, I may be able to make more specific suggestions.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

appendcols is rarely useful, IMO. As you've discovered, it combines events without regard for the value of any field.

Depending on the nature of your data and what you want to do with the results, you should consider the stats or join command. The former is more efficient, but can be tricky to get the right results.

If you post some sample events or queries, I may be able to make more specific suggestions.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...