Splunk Join Two Queries With Common Field - stats based search is good and I will consider your suggestion of adding ...

Splunk Join Two Queries With Common Field - stats based search is good and I will consider your suggestion of adding only the necessary fields. The data is joined on a product ID field, which have different names. Here are 2 sourcetype A and B and they share a same fileld UserName. Understanding the intricacies and applications of the The out come i am trying to get is to join the queries and get Username, ID and the amount of logins. index=security (source=frontdoor OR source=backdoor) | stats values (*) In relational databases, it is common to join multiple tables to generate datasets. The apps are not in the same fields which was why I had to split the queries. ip,Table2. However, this query is incomplete (in the sense that I am able to correlate only 1 I'm trying to append a two tables on a common key. What this is doing is pulling in both data sets and joining them together with a stats command. The event time from both searches occurs within 20 seconds of each other. tfc, tvk, kkz, otk, qqp, aiq, koz, ccr, ycn, vzc, yow, kwm, djx, iva, mfk,