title: splunk join 2 search queries
body: <p>I am writing a splunk query to find out top exceptions that are impacting client. So I have 2 queries, one is client logs and another server logs query. Joined both of them using a common field, these are production logs so I am changing names of it. I am trying to find top 5 failures that are impacting client. below is my query.</p>
  
  <pre><code>index=pirs sourcetype=client-* env=* (type=Error error_level=fatal) error_level=fatal serviceName=FailedServiceEndpoint | table _time,serviceName,xab,endpoint,statusCode | join left=L right=R where L.xab = R.xab [search index=zirs sourcetype=server-*  | rex mode=sed field=span_name "s#\..*$##" | search span_success = false spanName=FailedServiceEndpoint |  table _time,spanName,xab] | chart count over L.serviceName
  </code></pre>
  
  <p>I explicitly mentioned a service name in here, In the final query there wont be service name, because we need top 5 failures that are impacting client. </p>
  
  <p>This query provides me with service name and count, I also need other columns like endpoint name, httpStatusCode I am not sure how to do that and also if there is anything refactoring required for splunk query? </p>