Splunk Search

Joining Two Sources

raghu0463
Explorer

Hi,

i was using data from 2 different sources, and joining with join key word, my question is when i want to display the output fields using table key word, if the fields are unique i can just give the field name, if there is a field with same name from both the sources then how should i output the field from only particular source.

Tags (2)
0 Karma
1 Solution

sbbadri
Motivator

Please see below

index=aaa source=a.log field1=* field2=* | join [ search index=aaa source=b.log field1=* field2=* | rename field1 as field1.b, rename field2 as field2.b | fields field1.b field2.b ] | table field1 field2 field1.b field2.b

View solution in original post

0 Karma

sbbadri
Motivator

Please see below

index=aaa source=a.log field1=* field2=* | join [ search index=aaa source=b.log field1=* field2=* | rename field1 as field1.b, rename field2 as field2.b | fields field1.b field2.b ] | table field1 field2 field1.b field2.b

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You've to rename the common field in the join subsearch (second search). As you'd have already figured out, the join command is slow as sloth, so if you could share your current join search and describe your requirement, we may be able to suggest something more efficient.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...