Hello fellow Splunkers
I'm trying to figure out how to join values from 2 indexes and return one field (from one of the indexes) based on a match. For example; we have inventory IDs (eid) in 1 index and contact details in another - both indexes have a unique ID value that's used to group things together (eid field)
I'd like to run a search that returns just the contact field/value when the ID matches 1 to 1 with the numerical ID coming back in a search.
indexA e_length e_location e_id e_category indexB weight last_shipment e_id contact
I'd like to join on the e_id field and return only the contact information from indexB when both id fields match.
something like |table elength, elocation, eid, ecategory, contact
Give this a shot :
index=A OR index=B
| stats values(contact) as contact values(index) as index by e_id
| search index=A AND index=B
That will give you contacts that have their e_id in both indexes. Add the other values you need after the stats.
I should've stated that I had this working with join. However, upon further reading it seems like the recommendation is to avoid join AND append when possible. But I couldn't get it working with stats...
you're not wrong. try this instead.
index=A OR index=B | stats values(e_length) as e_length values(e_location) as e_location values(e_category) as e_category values(contact) as contact by e_id