How to list results from two events that are linked via common field?

[Steve_A200]

I would like to list results from two events that are linked via common field (system_id), but searched via value only found in one event.

Event1:
client
phone_number
request_type
system_id

Event2:
client_bank
bank_request
response_code
system_id

Both events share the same system_id, however, I only know the phone_number and need to use that to list both events.

Any help would be greatly appreciated.

[richgalloway]

Here's one way.  There are others.

<search for Event1>
| append [ search <search for Event2> ]
| stats values(*) as * by system_id

[isoutamo]

Hi

couple or usable presentation / answers:

• https://conf.splunk.com/files/2020/slides/TRU1761C.pdf
• https://community.splunk.com/t5/Splunk-Search/What-is-the-relation-between-the-Splunk-inner-left-joi...

r. Ismo