Hello,
Sorry, still trying to get the hang of Search queries. I am tasked with creating a table that displays a server name from one search, with a team name from another search that corresponds with the server name. In example,
1st Search
index="netscaler | table servername
Results in a table like:
servername1
servername2
2nd Search
index="main | table teamname
Results in a table like
teamname1
teamname2
I need to make 1 table that will display the corresponding teamname to the servername. Like If servername = servername2, display teamname2 in the same table row.
Does that make sense. 🙂 Let me know if any details are needed. Not sure how to do this one.
Thanks for any help,
Tom
It might be helpful if you shared some sample (anonymised) events from your searches, preferably in raw format in codeblocks (using the </> button above)
The two searches have no obvious relationship to each other. How is Splunk to know how to match a server name to a team name?
Hello,
Thanks for your help, I am hoping for a way in the search to say something like if name from first query = servername1 then name from second query = teamname1. But, have no idea how to achieve that.
Thanks,
Tom
Yes, you said that in the OP, but what is the logic behind that matching? The query needs an algorithm it can use to pair servers with teams. Otherwise, you're looking at creating a lookup table that does the matching.