topic Re: subsearch join in Splunk Dev

subsearch join

sarit_s — Mon, 17 Jan 2022 14:35:21 GMT

Hello

I have a field that does not return results when searching for specific string.

i need to combine two searches so i will be able to return this field + other results from the search with the specific string

this is my query :

sourcetype=clientlogs OR sourcetype="client-logs-api" Categories="Login" | stats count(eval( Message="Unable to load " OR Message="Unable to load from SDK")) as Faliure, values(Message) as Message values(IPAddress) as IPAddress, values(Url) as url by Country SessionGuid | appendpipe [ stats sum(Faliure) as Faliure | fillnull value=0 Faliure | eval Country="TOTAL" ] | appendpipe [ stats count(SessionGuid) as FailedSessions | eval Country="TOTAL",Faliure="Faliure"] ] | table SessionGuid IPAddress Country Faliure Message FailedSessions url | sort - Faliure

i need to add the field CID which return no results when searching for the message at the beginning of the query

how can i join them together so i will see in the table also the values of CID ?

Re: subsearch join

ITWhisperer — Mon, 17 Jan 2022 15:01:09 GMT

I am not sure I understand the requirement - do you want a list of CID where Categories != "Login" or a list of CID where message = "Unable to load " OR message = "Unable to load from SDK" or a list of CID where message != "Unable to load " AND message != "Unable to load from SDK" or something else?

Re: subsearch join

sarit_s — Mon, 17 Jan 2022 15:02:38 GMT

I want list of CID's when

sourcetype=clientlogs OR sourcetype="client-logs-api"

and add it to the table

Re: subsearch join

ITWhisperer — Mon, 17 Jan 2022 15:09:10 GMT

| append [search sourcetype=clientlogs OR sourcetype="client-logs-api" | stats values(CID) as CID]

Re: subsearch join

sarit_s — Mon, 17 Jan 2022 15:13:16 GMT

CID still empty

Re: subsearch join

ITWhisperer — Mon, 17 Jan 2022 16:26:16 GMT

So CID doesn't exist in these sourcetypes?

If it does, how would you list them?

Re: subsearch join

sarit_s — Mon, 17 Jan 2022 16:30:05 GMT

It does.
if im searching only for those sourcetyps i can find CID

but when i append this search with the rest it returns empty