title: Splunk query to take a search from one index and add a field's value from another index?
body: <p>How can I write a Splunk query to take a search from one index and add a field's value from another index? I've been reading explanations that involve joins, subsearches, and coalesce, and none seem to do what I want -- even though the example is extremely simple. I am not sure what I am not understanding yet.</p>
  <p>main-index has src field which is an IP address and a field I will restrict my results on. I will look over a short amount of time, e.g.</p>
  <pre><code>index=&quot;main-index&quot; sourcetype=&quot;main-index-source&quot; main-index-field=&quot;wildcard-restriction*&quot; earliest=-1h | stats count by src
  </code></pre>
  <p>other-index has src_ip field which is an IP address, and has the hostname. It's DHCP leases, so I need to check a longer time frame, and return only the most recent result for a given IP address. I want to get back the hostname from src_nt_host, e.g.</p>
  <pre><code>index=&quot;other-index&quot; sourcetype=&quot;other-index-sourcetype&quot; earliest=-14d
  </code></pre>
  <p>I would like to end up with the following values:</p>
  <pre><code>IP address, other-index.src_nt_host, main-index.count
  </code></pre>
  <p>main-index has the smallest amount of records, if that helps for performance reasons.</p>