Splunk Search

Hunk - Join 2 Virtual Indexes

tt1
Explorer

Hi,

I have 2 virtual indexes, both return data, and both return for a specific search.

But if I try and join and get no results, and if I try an 'or' I get no results.

index=filea ID=201 .. events

index=fileb ID=201 .. event

index=filea or index=fileb .. no events

index=filea or index=fileb | top 20 url .. no events

index=filea | join ID[fileb] .. no events

on one file the ID was found from within JSON format data, the other was done via an 'extract fields' from a messy log file.

Any thoughts appreciated.

Tags (4)
0 Karma
1 Solution

tt1
Explorer

'OR' instead of 'or' makes all the difference .....

that moment when joy is mixed with frustration ....

thanks for looking

View solution in original post

0 Karma

tt1
Explorer

'OR' instead of 'or' makes all the difference .....

that moment when joy is mixed with frustration ....

thanks for looking

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!