How do get the combined search result?

[kamaleshwar]

I want to get the combined result of two events. E.g The first event have reference ID, Name & IP and the second event contains Email ID & reference ID. So here I need to get the combined result of first and second events. i.e., It would be like "Reference ID, Name, IP & Email". Is there any possibility to join both event values?

I have to get these results with 2 searches as below

sourcetype="" "Name" AND "IP address" referenceId!="" | Table referenceId

index="" referenceId AND Email

[renjith_nair · Accepted solution]

You can use join, transaction, or simply stats to obtain this.

Join: http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Join
Example:

index=a source=abc ... | join referenceid [search index=b source=xyz ....]

Transaction: http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Transaction
Example:

index=abc sourcetype=access_* | transaction referenceid maxspan=30s maxpause=5s

Stats: https://answers.splunk.com/answers/204782/how-to-join-two-search-events-that-have-a-common-f.html
Example:

A OR B OR C | stats values(Name) as Name, values(IP) as IP,values(Email) as Email  by referenceid

Also refer to
http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Commandsbycategory