JOIN two tables in Splunk

[kthakkar]

Need to extract the value of 'A' from Query 1 -
Then do a JOIN to extract the value of 'A' if they occur in Query 2
Match the value of 'A' to corresponding values of 'B' which are a part of the Query 2.

I am able to get the JOIN working and it gives me all the A's that occur in the Query 2. Now I need to extract the value of corresponding 'B' in Query 2.

[krugger]

More information would be nice, but from what you wrote I can suggest this:

index="AAA" somecondition |
rename somefieldA as commonfield |
join commonfield [ search index="BBB" anothercondition | table commonfield,additionalinfoB ]

This will produce a table with the information from AAA plus the additional information from B where somefieldA is equal to commonfield in B.

[lguinn2]

Sorry but this is not enough information. Can we see the actual query? We especially need to see the query where join is working. Also, the 'A' query and the 'B' query.

Also, what is the criteria for joining 'A' and 'B'? is there a transaction id or key that is common to both queries?