Splunk Search

Hunk - Join 2 Virtual Indexes

tt1
Explorer

Hi,

I have 2 virtual indexes, both return data, and both return for a specific search.

But if I try and join and get no results, and if I try an 'or' I get no results.

index=filea ID=201 .. events

index=fileb ID=201 .. event

index=filea or index=fileb .. no events

index=filea or index=fileb | top 20 url .. no events

index=filea | join ID[fileb] .. no events

on one file the ID was found from within JSON format data, the other was done via an 'extract fields' from a messy log file.

Any thoughts appreciated.

Tags (4)
0 Karma
1 Solution

tt1
Explorer

'OR' instead of 'or' makes all the difference .....

that moment when joy is mixed with frustration ....

thanks for looking

View solution in original post

0 Karma

tt1
Explorer

'OR' instead of 'or' makes all the difference .....

that moment when joy is mixed with frustration ....

thanks for looking

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!