create a table by comparing data from 2 different indexes

[arjun_hcl]

Hi,
I am trying to create a table by comparing data from 2 different indexes & compare certain search terms from one index with matching events from second index

for e.g
index1 may contain a field word and terms error, down, fatal
index2 may contain a field ticket and terms tkt1, tkt2, tkt3

idea is to write duplicate values of tickets against each matiching terms from index1

output would be like
Ticket | word
tkt1 | error
tkt1 | down
tkt1 | fatal
tkt2 | error
tkt2 | down
tkt2 | fatal
.
.
.
etc.

can someone help plz?

[niketn]

@arjun_hcl... you would need to provide one key piece of information. Do you have any correlation field between the two indexes?

Consider index and sourcetype in Splunk to be Database and tables. For correlating them we would need to establish a foreign key which is present in both.

If possible please mock up your sample events from both indexes and post them here so that we can help you with the query you need. Do let us know the sourcetype for both indexes also.

[earlhelms]

I'm not sure if I understand the question but this seems to call for a join. Reference: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Join