Splunk Search

SPL search query to combine two tables

MikeJu25
Path Finder

Hi,

I have database table and anomaly table. Both tables have a field database_id. Now I am interested in the status and confidence fields in anomaly table as well as data_source and ip fields in database table. I want to combine them into one table based on the database_id. I tried some queries like below but its result was not as expected. 

 

 

 

index=anomalies | JOIN type=left database_id [SEARCH index=assets] | fields anomaly_id, confidence, current_status, database_id, source_type, ip 

 

 

 

 How could I write a query that returns a table showing the info for all anomalies as well as the database info related to that anomaly using database_id as a bridge? 

Thank you in advance!

Regards,

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In what way were they not as expected?

0 Karma

MikeJu25
Path Finder

Seems like it works for now! Thank you!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...