i need to use a splunk join,
i want ask is possible use two field with OR condition
my search | fields column 1, column 2, column 3 | join cloumn 1 OR column 2 [ my second search]
For your time
Skip join entirely (it has inescapable limits) and do this
my saearch OR my second search | eval joiner=coalesce(column1, column2) | stats values(*) AS* BY joiner | fields - joiner
Just try it before you think it won't work.
View solution in original post
no you cannot use an OR condition in a join.
What's the problem values in column1 and column2?
if this is the problem you could use an eval with coalesce function
| eval column=coalesce(column1,column2)
| join column [ my second search]
i try to use olny one column beacause the second sometimes is null but i can't use coalesce beacuase i need column 2= null
thank for your time