Splunk Search

Using another index and replace the missing values in the current index data.

veerendra_modi
Loves-to-Learn

I have a index say index1 having Air Details and ServerName of which some Air is missing for some serverNames.

I have another index say index2 in this index i am getting the Air details that are missing in index1.

Want to use index2 Air where i dont have values in index 1.

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There needs to be a connection between index1 and index2 so Splunk knows which ServerName belongs to which Air Details.  Once you have that you can join the two indexes something like this

(index=index1 OR index=index2)
| stats values(*) as * by ServerName
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...