Splunk Search

Join with different fields names.

brodde
Engager

Hi,

I'm trying to port some SQL queries we wrote to Splunk but whereas with SQL I can specify which columns to join whatever their names are I couldn't replicate that in Splunk.

Here's an attempt using aliases (rename didnt work either) :

   sourcetype="call"
    | join type=left callerID as userId
       [search sourcetype="user"
       | fields userId]
    | table event_id callerID userId

Thanks !

Tags (1)

martin_mueller
SplunkTrust
SplunkTrust

Rename certainly works.

If you have two sources like this:

user, field1
foo, value2

and like this:

userId, field2
foo, value2

you can do a search like this:

sourcetype=st1 | rename user as userId | join userId [search sourcetype=st2]

to get this:

userId, field1, field2
foo, value1, value2
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...