This is a repeated question.I am posting it again because I cant find a solution.
I have 2 data sets which contain a common data.(Columns names are different in 2 data set).
EmpId and EId are columns I want to join.
In Data1 and Data2 have one to many relations.
Both of this data set will be loaded in splunk on daily basis.So I want to join them and show the result on a day by basis (like timechart does).
Ie I want to join today's Data1 with today's Data2.
I tired below things but both of them doesn't work out.
1)host=Data1 OR Data2| eval employerCode = if(host="Data1","EId", employer_code) |transaction employerCode maxspan=1d
2)host=Data1|join EmpId [search host=Data2 | eval "EId"=EmpId]|eventstats .....
can anybody help me?
'host=Data1 | rename EmpId AS employerCode | join employerCode [search host=Data2 | rename EId AS employerCode ... '. Of course, this means any downstream use of
EId will have to use