Splunk Search

Joining data

jimjohn
Path Finder

Hi All,
This is a repeated question.I am posting it again because I cant find a solution.

I have 2 data sets which contain a common data.(Columns names are different in 2 data set).
Ex:
Data1 Data2
EmpId EId
Name Visit
Age
EmpId and EId are columns I want to join.
In Data1 and Data2 have one to many relations.
Both of this data set will be loaded in splunk on daily basis.So I want to join them and show the result on a day by basis (like timechart does).
Ie I want to join today's Data1 with today's Data2.

I tired below things but both of them doesn't work out.

1)host=Data1 OR Data2| eval employerCode = if(host="Data1","EId", employer_code) |transaction employerCode maxspan=1d

2)host=Data1|join EmpId [search host=Data2 | eval "EId"=EmpId]|eventstats .....

can anybody help me?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try 'host=Data1 | rename EmpId AS employerCode | join employerCode [search host=Data2 | rename EId AS employerCode ... '. Of course, this means any downstream use of EmpId or EId will have to use employerCode instead.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please accept the answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jimjohn
Path Finder

Thanks man...It works out....

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...