Splunk Search

SPL search query to combine two tables

MikeJu25
Path Finder

Hi,

I have database table and anomaly table. Both tables have a field database_id. Now I am interested in the status and confidence fields in anomaly table as well as data_source and ip fields in database table. I want to combine them into one table based on the database_id. I tried some queries like below but its result was not as expected. 

 

 

 

index=anomalies | JOIN type=left database_id [SEARCH index=assets] | fields anomaly_id, confidence, current_status, database_id, source_type, ip 

 

 

 

 How could I write a query that returns a table showing the info for all anomalies as well as the database info related to that anomaly using database_id as a bridge? 

Thank you in advance!

Regards,

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In what way were they not as expected?

0 Karma

MikeJu25
Path Finder

Seems like it works for now! Thank you!

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...