Splunk Search

Joining two tables without common field or key. All rows of 1st table must join with all the rows of the second one

nkankur
Path Finder

I have data as given below in table format
A B C D E F
517 2498 186 1000 250 100
399 314 1559 100 100 1000

I want each row of D E and F against each row of A B and C kind of cross transformation
output should look like this:
A B C D E F
517 2498 186 1000 250 100
517 2498 186 100 100 1000
399 314 1559 1000 250 100
399 314 1559 100 100 1000

Thanks in advance!

Tags (2)
0 Karma
1 Solution

p_gurav
Champion

Can you try something like :

    index="your_index" | table A B C | join type=left max=0 [search index="your_index" | table D E F]

View solution in original post

0 Karma

logloganathan
Motivator

Please refer this document

https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Eval

by using this command, you can use logic for cross transformation

0 Karma

p_gurav
Champion

Can you try something like :

    index="your_index" | table A B C | join type=left max=0 [search index="your_index" | table D E F]

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!