Joining Two Sources

[raghu0463]

Hi,

i was using data from 2 different sources, and joining with join key word, my question is when i want to display the output fields using table key word, if the fields are unique i can just give the field name, if there is a field with same name from both the sources then how should i output the field from only particular source.

[sbbadri · Accepted solution]

Please see below

index=aaa source=a.log field1=* field2=* | join [ search index=aaa source=b.log field1=* field2=* | rename field1 as field1.b, rename field2 as field2.b | fields field1.b field2.b ] | table field1 field2 field1.b field2.b

[somesoni2]

You've to rename the common field in the join subsearch (second search). As you'd have already figured out, the join command is slow as sloth, so if you could share your current join search and describe your requirement, we may be able to suggest something more efficient.