https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/340002#M100827 <P>I'm so stupid ! </P> <P>Thanks Somesoni2</P> Thu, 20 Apr 2017 16:36:58 GMT Abarny 2017-04-20T16:36:58Z https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/339996#M100821 <P>hi guys,<BR /> I want to filter my request where when logs{}.newStateId!=5 i recover the projects{}.id but this <CODE>join</CODE> isn't match and give all projects{}.id . I can't see projects{}.icma cause it takes the values on the first <CODE>join</CODE> and i would have all projects{}.icma by projects{}.id.</P> <P>Can you tell me what wrong on my request :</P> <PRE><CODE>index="gtav2_projects" |fields projects{}.id, projects{}.client.name,projects{}.icma | stats list(projects{}.id) as projet by projects{}.client.name | join[search index="gtav2_projects" projects{}.icma="xxx"] | join [search index="gta_projets" logs{}.newStateId!=5 |fields logs{}.projectId | rename logs{}.projectId as 'projet' ] |rename projects{}.client.name as Client|table Client, projet, projects{}.icma </CODE></PRE> <P>Thanks you very much for your answers,</P> Thu, 20 Apr 2017 15:14:48 GMT https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/339996#M100821 Abarny 2017-04-20T15:14:48Z https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/339997#M100822 <P>Give this a try</P> <PRE><CODE>index="gtav2_projects" [search index="gta_projets" logs{}.newStateId!=5 |fields logs{}.projectId ] | stats list(projects{}.id) as projet by projects{}.client.name | join[search index="gtav2_projects" projects{}.icma="xxx"] |rename projects{}.client.name as Client|table Client, projet, projects{}.icma </CODE></PRE> Thu, 20 Apr 2017 15:34:25 GMT https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/339997#M100822 somesoni2 2017-04-20T15:34:25Z https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/339998#M100823 <P>It's okay but i don't have projects{}.icma. I have just xxx and 1 ICMA = 1 projectId. Do you know how i can do that ?</P> Thu, 20 Apr 2017 15:47:23 GMT https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/339998#M100823 Abarny 2017-04-20T15:47:23Z https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/339999#M100824 <P>So you want to exclude projects which has <CODE>projects{}.icma="xxx"</CODE> Or only include those?</P> Thu, 20 Apr 2017 16:11:15 GMT https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/339999#M100824 somesoni2 2017-04-20T16:11:15Z https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/340000#M100825 <P>I want find all project about this Client. With <CODE>projects{}.icma="xxx"</CODE> I find Client, I recover all <CODE>projectId</CODE> about this Client and i would all <CODE>projects{}.icma</CODE> because each <CODE>projectId</CODE> has an <CODE>icma</CODE>.</P> <P>Thanks you for your answer</P> Thu, 20 Apr 2017 16:28:36 GMT https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/340000#M100825 Abarny 2017-04-20T16:28:36Z https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/340001#M100826 <P>Try this</P> <PRE><CODE>index="gtav2_projects" [search index="gta_projets" logs{}.newStateId!=5 |fields logs{}.projectId ] | join[search index="gtav2_projects" projects{}.icma="xxx"] | stats list(projects{}.id) as projet list(projects{}.icma) as icma by projects{}.client.name |rename projects{}.client.name as Client|table Client, projet, projects{}.icma </CODE></PRE> Thu, 20 Apr 2017 16:34:27 GMT https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/340001#M100826 somesoni2 2017-04-20T16:34:27Z https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/340002#M100827 <P>I'm so stupid ! </P> <P>Thanks Somesoni2</P> Thu, 20 Apr 2017 16:36:58 GMT https://community.splunk.com/t5/Splunk-Search/How-filter-with-join/m-p/340002#M100827 Abarny 2017-04-20T16:36:58Z