×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
ved08514
Explorer
Member since: ‎10-27-2020
‎10-29-2020
Community Statistics
Posts 8
Solutions 0
Karma Given 3
Karma Received 0
Member Since ‎10-27-2020
Activity Feed
View All

Re: Join two indexes based on substring match

by in Splunk Search
‎10-29-2020 03:38 AM
‎10-29-2020 03:38 AM
@ITWhisperer  Thanks. That worked. ... View more

Re: Join two indexes based on substring match

by in Splunk Search
‎10-29-2020 03:00 AM
‎10-29-2020 03:00 AM
@ITWhisperer  I just saw below error in Job button dropdown stats' command: limit for values of field 'nip' reached. Some values may have been truncated or ignored. ... View more

Re: Join two indexes based on substring match

by in Splunk Search
‎10-29-2020 02:45 AM
‎10-29-2020 02:45 AM
@ITWhisperer  I tried to modify the runanywhere data in original query you provided. There also I am seeing the same issue. I added more records in index2 like 400 but I am seeing less data. Attached full query. ... View more

Re: Join two indexes based on substring match

by in Splunk Search
‎10-29-2020 01:19 AM
‎10-29-2020 01:19 AM
@ITWhisperer  I am facing one issue here. even if my index is having 600+ records i am getting only 200 records in output. I tried to increase number of records in index but still it showing 200 records. ... View more

Re: Join two indexes based on substring match

by in Splunk Search
‎10-28-2020 05:32 AM
‎10-28-2020 05:32 AM
Hi @ITWhisperer Thanks a lot for solution. Actually field directory name in index2 is "dir2". I tried to rename it to "dir" but its overwriting all the values in index1. It works fine if both the index has "dir" as field name.   ... View more

Re: Join two indexes based on substring match

by in Splunk Search
‎10-27-2020 04:35 AM
‎10-27-2020 04:35 AM
Hi @ITWhisperer  FILEPATTERN  and DIRECTORYNAME  combination in index2 is unique (i.e. its like composite key for index2).  Whereas for index1 there are no unique combination. ... View more

Join two indexes based on substring match

by in Splunk Search
‎10-27-2020 04:06 AM
‎10-27-2020 04:06 AM
Hi, I am struggling with joining two indexes based on substring match. I have following indexes : index1 : having following fields PROTOCOL,DIRECTION,FILENAME,DIRECTORYNAME   index2: having following fields APPID,CUSTOMERID,FILEPATTERN,DIRECTORYNAME I want to join above indexes based on following condition  1. FILEPATTERN is substring of FILENAME 2. DIRECTORYNAME in index1 = DIRECTORYNAME in index 2. and display output with following fields PROTOCOL,DIRECTION,APPID,CUSTOMERID,FILEPATTERN,DIRECTORYNAME Thanks in anticipation Regards Nikhil  ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎10-29-2020 11:10 AM
Karma given to
View All