I have two join two different source file having similar column
Source1 ( basically iostat data and loaded to splunk for every minute)
_time,hdisk,host,disk_usage...
20191128.024935,hdisk1,host1,30
20191128.024935,hdisk2,host1,40
20191128.024935,hdisk3,host1.50
source2 (having disk and its file system mapping ..populated daily once)
filesystem
/fs1,hdisk1
/fs2,hdisk2
/fs3,hdisk3
both source1 and source2 mapped to single source type
How can i join both sources in splunk so i get the data in below format
_time,hdisk,host,disk_usage,filesystem
20191128.024935,hdisk1,host1,30,/fs1
20191128.024935,hdisk2,host1,40,/fs2
20191128.024935,hdisk3,host1.50,/fs3
↧