Splunk Search

How to build a table from two index sources with a common id

nottheboss
Engager

I am completely new to splunk so correct me if i am wrong
i have 2 sources of data which contains status codes for the request with an id
1) index=some_index_1 source=some_source_1 status_code=* id=*
2) index=some_index_2 source=some_source_2 status_code=* id=*

i would like a table with
id, status_code (from index_1), status_code (from index_2)

how can i join the two data together and return a table with the fields?

Tags (1)
0 Karma
1 Solution

elliotproebstel
Champion

This can be a start, and you can adjust it as needed:

index=some_index_1 OR index=some_index_2 source=some_source1 OR source=some_source_2 
| eval status_code_1=if(index=some_index_1, status_code, NULL), status_code_2=if(index=some_index_2, status_code, NULL)
| stats values(status_code_1) AS status_code_1, values(status_code_2) AS status_code_2 BY id

View solution in original post

elliotproebstel
Champion

This can be a start, and you can adjust it as needed:

index=some_index_1 OR index=some_index_2 source=some_source1 OR source=some_source_2 
| eval status_code_1=if(index=some_index_1, status_code, NULL), status_code_2=if(index=some_index_2, status_code, NULL)
| stats values(status_code_1) AS status_code_1, values(status_code_2) AS status_code_2 BY id
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...