Splunk Search

Splunk SPL join

Path Finder

Hi Experts,

Please suggest how to join two Splunk index output.
I have two indexes in first index i want to fetch only that data that occurred in holiday list occurrence-date field

index=monitor
index=holiday_list earliest=0 latest=now| dedup OCCURRENCEDATE| table OCCURRENCEDATE

Tags (2)
0 Karma

Influencer

Try this:

index=monitor [search index=holiday_list earliest=0 latest=now| stats count by OCCURRENCEDATE | fields OCCURRENCEDATE]
0 Karma