Splunk Search

Joining two tables without common field or key. All rows of 1st table must join with all the rows of the second one

nkankur
Path Finder

I have data as given below in table format
A B C D E F
517 2498 186 1000 250 100
399 314 1559 100 100 1000

I want each row of D E and F against each row of A B and C kind of cross transformation
output should look like this:
A B C D E F
517 2498 186 1000 250 100
517 2498 186 100 100 1000
399 314 1559 1000 250 100
399 314 1559 100 100 1000

Thanks in advance!

Tags (2)
0 Karma
1 Solution

p_gurav
Champion

Can you try something like :

    index="your_index" | table A B C | join type=left max=0 [search index="your_index" | table D E F]

View solution in original post

0 Karma

logloganathan
Motivator

Please refer this document

https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Eval

by using this command, you can use logic for cross transformation

0 Karma

p_gurav
Champion

Can you try something like :

    index="your_index" | table A B C | join type=left max=0 [search index="your_index" | table D E F]
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...