Splunk Search

how to merge data from different two source ?

sangjoonlee
New Member

my data is csv file

My data below

source = A1
field name = a1, b1, c1,...

soruce = A2
field : a1, b2, c2,...
field : a1, b3, c3,..
field : a1, b4, c4,..
.
.
.

.

I wand to make a table

a1, b1, c1, b2, c2
a1, b1, c1, b3, c3
a1, b1, c1, b4, c4

Tags (3)
0 Karma
1 Solution

hhGA
Communicator

Hi sangjoonlee,

If a1 is present in both sources then you can use join:

<source 1 search> | join a1 [search <source 2 search> | table a1, b1, c1, b2, c2]

Hope this helps.

View solution in original post

hhGA
Communicator

Hi sangjoonlee,

If a1 is present in both sources then you can use join:

<source 1 search> | join a1 [search <source 2 search> | table a1, b1, c1, b2, c2]

Hope this helps.

sangjoonlee
New Member

thank you.

0 Karma

3no
Communicator

a1 field is in both file ? In every line ?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...