Join is one way to do it, but can be inefficient. If you use join, understand that Splunk will match events based only on the specified field name(s) (or all common fields if none are specified). Another way to combine results is using append. index=a sourcetype=test
| append [search index b | rename id as idb]
|stats count by id, idb Yet another way, and probably the best way if I understand the use case correctly, is to use a subsearch. A subsearch runs before the main search and its results become part of the main search. index=a sourcetype=test [search index b | fields id | format ]
|stats count by id The format command converts the subsearch results into a boolean expression the main search can evaluate. It's important for the subsearch to return field names that exist in the main search otherwise it may fail to find the right results.
... View more