Splunk SPL join

[arun_kant_sharm]

Hi Experts,

Please suggest how to join two Splunk index output.
I have two indexes in first index i want to fetch only that data that occurred in holiday list occurrence-date field

index=monitor
index=holiday_list earliest=0 latest=now| dedup OCCURRENCEDATE| table OCCURRENCEDATE

[manjunathmeti]

Try this:

index=monitor [search index=holiday_list earliest=0 latest=now| stats count by OCCURRENCEDATE | fields OCCURRENCEDATE]