- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to Join fields from 2 indexes
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello!
I am trying to make a dashboard with fields from 2 indexes using the command "join".
I wrote a search source="WinEventLog:Security" EventCode=4624 AccountName!="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [index=anotherindex employeeID=*] | table _time, user, employeeID
But column employeeID is empty. What did I do wrong?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use this one
source="WinEventLog:Security" EventCode=4624 AccountName="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [search index=anotherindex employeeID=* ] | table _time, user, employeeID
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use this one
source="WinEventLog:Security" EventCode=4624 AccountName="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [search index=anotherindex employeeID=* ] | table _time, user, employeeID
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
glad it resolved your issue
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I found one more mistake in this search and now it works properly.
Your answer resolved my issue. Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I added "search" but column "employeeID" is still empty.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
And I found a mistake - there is "AccountName*!="$""
source="WinEventLog:Security" EventCode=4624 AccountName!="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [ search index=anotherindex employeeID=* ] | table _time, user, employeeID
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
chersss!!!
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
