Splunk Search

Hunk - Join 2 Virtual Indexes

tt1
Explorer

Hi,

I have 2 virtual indexes, both return data, and both return for a specific search.

But if I try and join and get no results, and if I try an 'or' I get no results.

index=filea ID=201 .. events

index=fileb ID=201 .. event

index=filea or index=fileb .. no events

index=filea or index=fileb | top 20 url .. no events

index=filea | join ID[fileb] .. no events

on one file the ID was found from within JSON format data, the other was done via an 'extract fields' from a messy log file.

Any thoughts appreciated.

Tags (4)
0 Karma
1 Solution

tt1
Explorer

'OR' instead of 'or' makes all the difference .....

that moment when joy is mixed with frustration ....

thanks for looking

View solution in original post

0 Karma

tt1
Explorer

'OR' instead of 'or' makes all the difference .....

that moment when joy is mixed with frustration ....

thanks for looking

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...