Splunk Search

SPL search query to combine two tables

MikeJu25
Path Finder

Hi,

I have database table and anomaly table. Both tables have a field database_id. Now I am interested in the status and confidence fields in anomaly table as well as data_source and ip fields in database table. I want to combine them into one table based on the database_id. I tried some queries like below but its result was not as expected. 

 

 

 

index=anomalies | JOIN type=left database_id [SEARCH index=assets] | fields anomaly_id, confidence, current_status, database_id, source_type, ip 

 

 

 

 How could I write a query that returns a table showing the info for all anomalies as well as the database info related to that anomaly using database_id as a bridge? 

Thank you in advance!

Regards,

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In what way were they not as expected?

0 Karma

MikeJu25
Path Finder

Seems like it works for now! Thank you!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...