How to rename fields having the same name in JOIN command?

[piscriddo]

Hi,

I am executing a right join on two searches. Unfortunately, both search results have the same field names.

How can I rename the field of one search only, and not the other, in order to be able to display these values in a table?

Example

Search A: 
Order_id = 123
Operation = authorize
Result = 200

Search B:
Order_id = 123
Operation = secure
Result = 200

I want to right join Search A to Search B in order to obtain:

order_id	authorize	secure
123	200	200

Thanks!

[bowesmana]

It's often useful in Splunk to consider how you would do this without using join.

Typically to avoid join, you would include both data sets in the original search and then do aggregations on those as needed.

So, if you just had search A OR search B you would then be able to use @isoutamo 's chart statement to render the results.

[isoutamo]

Hi

you could try this:

| makeresults
| eval _raw="order_id, Operation, Result
123, authorize, 200
123, secure, 200" 
| multikv forceheader=1
| rename COMMENT as "prepare sample data"
| chart values(Result) as Result over order_id by Operation

r. Ismo