Joining data

[jimjohn]

Hi All,
This is a repeated question.I am posting it again because I cant find a solution.

I have 2 data sets which contain a common data.(Columns names are different in 2 data set).
Ex:
Data1 Data2
EmpId EId
Name Visit
Age
EmpId and EId are columns I want to join.
In Data1 and Data2 have one to many relations.
Both of this data set will be loaded in splunk on daily basis.So I want to join them and show the result on a day by basis (like timechart does).
Ie I want to join today's Data1 with today's Data2.

I tired below things but both of them doesn't work out.

1)host=Data1 OR Data2| eval employerCode = if(host="Data1","EId", employer_code) |transaction employerCode maxspan=1d

2)host=Data1|join EmpId [search host=Data2 | eval "EId"=EmpId]|eventstats .....

can anybody help me?

[richgalloway]

Try 'host=Data1 | rename EmpId AS employerCode | join employerCode [search host=Data2 | rename EId AS employerCode ... '. Of course, this means any downstream use of EmpId or EId will have to use employerCode instead.

[richgalloway]

Please accept the answer.

[jimjohn]

Thanks man...It works out....