Splunk Search

Show multi values

kig121
Loves-to-Learn Lots

Hi, i am a beginner.

I have 2 sourcetype (table). One of conatins requirement_id other ones conatins Testcase_id and requirement_id.

Must have: Join Testcase_id sourcetype to Requirement_id

 

Note: Sorting (ordering of Testcase_id sourcetype is not a solution, because requirment_id souercetype  table contains many other important attribute which is missing Testcase_id sourcetype.

Requirement id
1
2
3
4
5
Testcase_idRequirement_id
141
142
143
871
872
873
764
674
455

 

My Expectation:

Requirement_idTestcase_id
114
187
214
287
314
387
476
467
545
Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you could try the next

Index IN (<IDX 1>, … <IDX 2>) sourcetype IN (st1, st2)
| stats values(*) as * by Requirement_id, Testcase_id 
| sort Requirement_id

r. Ismo 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
search test case
| join requirement_id [search requirements]
| sort requirement_id
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...