Splunk Search

How to combine data based on a common field?

anooshac
Communicator

Hi all, i have some data task name, execution date, link uploaded earlier. Now i want to add some more data related to the task name they are component name, number of components. If i upload the 2nd data in the form task name , component name, number of components will i be able to get all data together based on one common field task name. Can anyone knows is there any solution for this?

My data are task name, execution date, link and the next set of data  is task name , component name, number of components.

Labels (2)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, you can either use join or stats by task name to aggregate the values from the fields on a common take name.

0 Karma

anooshac
Communicator

I don't want to just display the data directly using stats. My raw data has alot of processing to do and using join i am joining all these processed results. Is there any solution other than this?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Stats, just like any command, works on the events in the pipeline; you can choose where you put the stats command; you can have more than one stats command if that helps your use case.

0 Karma

anooshac
Communicator

when i use stats all the data including the data i don't want to display also shows. How to avoid these? I tried by putting table command after stats for the selected data but that doesn't work.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The table command can be used to limit the fields/columns - the where command can be used to limit the event/rows

0 Karma

anooshac
Communicator

Okay. Thank you so much.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...