Splunk Search

Splunk SPL join

arun_kant_sharm
Path Finder

Hi Experts,

Please suggest how to join two Splunk index output.
I have two indexes in first index i want to fetch only that data that occurred in holiday list occurrence-date field

index=monitor
index=holiday_list earliest=0 latest=now| dedup OCCURRENCEDATE| table OCCURRENCEDATE

Tags (2)
0 Karma

manjunathmeti
Champion

Try this:

index=monitor [search index=holiday_list earliest=0 latest=now| stats count by OCCURRENCEDATE | fields OCCURRENCEDATE]
0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...