Hi Experts,
Please suggest how to join two Splunk index output.
I have two indexes in first index i want to fetch only that data that occurred in holiday list occurrence-date field
index=monitor
index=holiday_list earliest=0 latest=now| dedup OCCURRENCEDATE| table OCCURRENCEDATE
Try this:
index=monitor [search index=holiday_list earliest=0 latest=now| stats count by OCCURRENCEDATE | fields OCCURRENCEDATE]