Splunk Search

Hunk - Join 2 Virtual Indexes

tt1
Explorer

Hi,

I have 2 virtual indexes, both return data, and both return for a specific search.

But if I try and join and get no results, and if I try an 'or' I get no results.

index=filea ID=201 .. events

index=fileb ID=201 .. event

index=filea or index=fileb .. no events

index=filea or index=fileb | top 20 url .. no events

index=filea | join ID[fileb] .. no events

on one file the ID was found from within JSON format data, the other was done via an 'extract fields' from a messy log file.

Any thoughts appreciated.

Tags (4)
0 Karma
1 Solution

tt1
Explorer

'OR' instead of 'or' makes all the difference .....

that moment when joy is mixed with frustration ....

thanks for looking

View solution in original post

0 Karma

tt1
Explorer

'OR' instead of 'or' makes all the difference .....

that moment when joy is mixed with frustration ....

thanks for looking

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...