How to merge search from 2 different sources?

[aymane96]

Hello,

I would like to do a search to filter some result matching my conditions and then use a common ID field to combine result with an other source.

Lets say :

SOURCE A :                       

• field ID 
• field x
• field y 

SOURCE B : 

• field ID 
• field z

I want to do a search with some condition on Source A : Index=A sourcetype=A'  "x=value" "y<=value"

and then use a join to get value "z"  for the result that i got from main search.

For now i have something like this :

index=A sourcetype=A'  "x=value" "y<=value"
| join [ search index=B sourcetype=B' | fields ID
| stats count by z

It does not seems to work. 

[aymane96]

Hello @gcusello,

Thank you for your quick answer 

I already tried to use the stats command. I just tried your method but the problem is that i have more result with this query than the main search: 

index=A sourcetype=A "x=value" "y<=value"

 It seems that it does not match only these result but it is more like it appends all the result of the search

index=B sourcetype=B

Actually, i want to use index B just for the information in field z,  the scope will be the result of the main search. 

[gcusello]

Hi @aymane96,

let me understand: has the main search results?

could you share some sample of x and y and value, to better understand conditions?

Ciao.

Giuseppe

[ITWhisperer]

index=A sourcetype=A  x="value"
| where y<=value
| join ID [ search index=B sourcetype=B | fields ID z ]
| stats count by z

[gcusello]

Hi @aymane96,

remember that Splunk isn't a DB, so join command must be used only when there isn't any other solution as last choice, because it's very slow and consumes many resources!

in you case, you could join the two sources using the stats command BY the common key (z), something like this:

(index=A sourcetype=A "x=value" "y<=value") OR (index=B sourcetype=B)
| stats values(x) AS x values(y) AS y count by z

if in addition you want also to put the condition that common key (z) values must be in both indexes, you could use something like this:

(index=A sourcetype=A "x=value" "y<=value") OR (index=B sourcetype=B)
| stats values(x) AS x values(y) AS y dc(index) AS dc_index count by z
| where dc_index=2

Ciao.

Giuseppe