Splunk® Cloud Services

SPL2 Search Reference

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

join command overview

Use the join command to combine the left-hand side dataset with the right-hand side dataset, by using one or more common fields. The left-hand side dataset is the set of results from a search that is piped into the join command. The left-hand side dataset is sometimes referred to as the source data. The right-hand-side dataset can be either a saved dataset or a subsearch.

The simplest join possible looks like this:

<left-dataset> | join left=L right=R 
where L.pid = R.pid <right-dataset>

This joins the source data from the search pipeline with the right-hand side dataset. Rows from each dataset are merged into a single row if the where predicate is satisfied.


The required syntax is in bold.

where <left-alias>.<left-field>=<right-alias>.<right-field>
[ AND <left-alias>.<left-field>=<right-alias>.<right-field> ]...

You can specify the aliases and fields in where clause on either side of the equal sign.
For example you can specify:

where <left-alias>.<left-field>=<right-alias>.<right-field>
where <right-alias>.<right-field>=<left-alias>.<left-field>

See also

join command
join command syntax details
join command usage
join command examples
Last modified on 14 July, 2021
into command examples
join command syntax details

This documentation applies to the following versions of Splunk® Cloud Services: current

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters