topic Re: Is there a way to make tables in a dashboard work together using two different sources? in Dashboards & Visualizations

Is there a way to make tables in a dashboard work together using two different sources?

Ragate — Mon, 02 Jul 2018 15:31:30 GMT

On my spunk dashboard I am showing tables with two different sources. Is there a way to have the tables sync up with the different data?
For example: If I have a License Key that appears in one table that matches the License Key (from a different source) in the other table, can it show the Documents Processed from this?

Do I need to create a search to merge these sources together or can I just do it through the dashboard?

Thanks in advance.

Re: Is there a way to make tables in a dashboard work together using two different sources?

kiamco — Mon, 02 Jul 2018 18:25:41 GMT

Try using the join command

eg:
your first search..
|join "License key" [|search second search]

Re: Is there a way to make tables in a dashboard work together using two different sources?

richgalloway — Mon, 02 Jul 2018 20:42:45 GMT

Yes, you must write an SPL query to combine the two searches. The dashboard will not do it for you.
Like @kiamco suggests, you can use join to combine them, but that is usually the least efficient way. Often, stats can used instead of join. See http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Join

Re: Is there a way to make tables in a dashboard work together using two different sources?

Ragate — Tue, 03 Jul 2018 12:36:50 GMT

I have tried using a join and this is what I came up:
source="C:\Users\ragate\Desktop\splunk\LMCustomerRevLicense.csv" | join type=left substr('context.custom.dimensions{}.LicenseKey' ,4,7) [search source="c:\users\ragate\desktop\splunk\jsondump.txt"] | eval LicenseKeyID=substr('context.custom.dimensions{}.LicenseKey' ,4,7) | where 'LicenseKeyID'='License Key Identifier'

This only brings but one event in each field when there should be about 20 more there. Not sure where I went wrong. Also have been told that stats would work but I am not sure how to use that to do what I want.

Re: Is there a way to make tables in a dashboard work together using two different sources?

richgalloway — Fri, 06 Jul 2018 12:44:09 GMT

The first argument to join after type=left should be a field name, not an expression.

source="C:\\Users\\ragate\\Desktop\\splunk\\LMCustomerRevLicense.csv" | eval LicenseKeyID=substr('context.custom.dimensions{}.LicenseKey' ,4,7) | join type=left LicenseKeyID  [search source="c:\\users\\ragate\\desktop\\splunk\\jsondump.txt" | eval LicenseKeyID=substr('context.custom.dimensions{}.LicenseKey' ,4,7)]

Re: Is there a way to make tables in a dashboard work together using two different sources?

Ragate — Fri, 06 Jul 2018 18:25:17 GMT

Thank you!