Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to Join fields from 2 indexes
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello!
I am trying to make a dashboard with fields from 2 indexes using the command "join".
I wrote a search source="WinEventLog:Security" EventCode=4624 AccountName!="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [index=anotherindex employeeID=*] | table _time, user, employeeID
But column employeeID is empty. What did I do wrong?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use this one
source="WinEventLog:Security" EventCode=4624 AccountName="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [search index=anotherindex employeeID=* ] | table _time, user, employeeID
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use this one
source="WinEventLog:Security" EventCode=4624 AccountName="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [search index=anotherindex employeeID=* ] | table _time, user, employeeID
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
glad it resolved your issue
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I found one more mistake in this search and now it works properly.
Your answer resolved my issue. Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I added "search" but column "employeeID" is still empty.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
And I found a mistake - there is "AccountName*!="$""
source="WinEventLog:Security" EventCode=4624 AccountName!="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [ search index=anotherindex employeeID=* ] | table _time, user, employeeID
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
chersss!!!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
How to Break a Kubernetes Pod on Purpose and Let the AI Troubleshooting Agent Find ...
Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster
What's New in Splunk Enterprise Security 8.8 and Beyond
