All Apps and Add-ons

Join 2 query based on common column

priya0709
Path Finder

How can i join two query table based on common column ( host), but i want to display all columns from 1st table but just 1 column ( Incident column) from 2nd table??

Labels (1)
0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust

query 1
| join Host [ query2]
| table Host, Time, Eventcode, Message, Incident

this is too slow , but it will work.

View solution in original post

to4kawa
SplunkTrust
SplunkTrust

What's the two queries and logs?

0 Karma

priya0709
Path Finder

Query 1 displays ( Host, Time, Eventcode, Message) 

Query 2 displays ( subject, Host, Incident)

i want to all match hosts in both column and based on that join the querys to display ( Host, Time, Eventcode, Message, incident)

0 Karma

to4kawa
SplunkTrust
SplunkTrust

query 1
| join Host [ query2]
| table Host, Time, Eventcode, Message, Incident

this is too slow , but it will work.

View solution in original post

priya0709
Path Finder

This worked but it is not displaying Host from query 1 even if it doesnt find any host in query 2??

my requirment is to match host but also display all output fro. Query 1??

0 Karma

to4kawa
SplunkTrust
SplunkTrust



please modify join option.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!