Splunk Search

Joining Tables

crmarley20
Explorer

Hello, 

I need your help please, I have two tables resulting from two searches and I need to join these two tables to make a cumulative bar chart according to date.

My tables are 

crmarley20_0-1644425055153.png

crmarley20_1-1644425077542.png

What I want to achieve is:

DatumA1A2A3A4A5A6
2022-02-085.7 3.71.94.5690.3

 

 

 

Labels (7)
0 Karma

BahadirS
Path Finder

Hello

You have two different formatted tables. You might want to transform the structure either on first search or second. 

 

first_search
| join type=left Schicht_Datum [ second_search | untable Schicht_Datum segment mid_result ]
| xyseries Schicht_Datum segment mid_result

 

 

0 Karma

VatsalJagani
Super Champion

Something like this:

<first table's search> | chart sum(mid_result) over segment
| append [| search <second table's search>]
| stats sum(*) as * by Schiche_Datum
| rename Schiche_Datum as Datum

Kindly ignore typos and fix column names if I mis-typed it.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What are your two searches?

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...