Just as you say, Splunk is not SQL. So, forget join. Please let us know what is the nature of the two searches, how close are they? What are their search periods? Most of the time, you shouldn't ...
See more...
Just as you say, Splunk is not SQL. So, forget join. Please let us know what is the nature of the two searches, how close are they? What are their search periods? Most of the time, you shouldn't run two separate searches, but instead, combine the two into one search, then try to get the result you need from that one search. Criteria being if there are duplicate values in fieldA, only the row with the latest value is kept and each row with fieldB joined to fieldA on same ID. or if there are no values for fieldA, just join with null/blank value Ideally, we can also throw away all rows with col fieldB that have a timestamp earlier than fieldA but not a hard requirement if that adds too much complexity to the query Here, you talk about "latest" and "earlier". But your mock data illustration contains no time information. How are volunteers supposed to help? Now, if you MUST run the two searches separately, yes, there are ways to produce right join output in SPL without using join command which most Splunkers advise against. But let's start at the ABCs of asking answerable questions in a data analytics forum. (That's right, this is not a SQL forum.) Here are four golden rules that I call Four Commandments: Illustrate data input (in raw text, anonymize as needed), whether they are raw events or output from a search that volunteers here do not have to look at. Illustrate the desired output from illustrated data. Explain the logic between illustrated data and desired output without SPL. If you also illustrate attempted SPL, illustrate actual output and compare with desired output, explain why they look different to you if that is not painfully obvious. Start from here.