topic Re: Why do I get a 400 stanza error when using a join command in searches? in Splunk Search

Why do I get a 400 stanza error when using a join command in searches?

tb5821 — Thu, 23 Aug 2018 15:28:39 GMT

I tried to add a simple join onto my search but Splunk throws a 400 error

{"messages":[{"type":"FATAL","text":"Missing or malformed messages.conf stanza for SEARCHFACTORY:UNKNOWN_OP__namespace"}]}

<Search>
| eventstats earliest(count) as earliest_count,earliest(_time) as earliest_time,latest(_time) as latest_time, latest(count) as latest_count by namespace
| where latest_count=earliest_count
| eval l_time=strftime(latest_time,"%m/%d/%y %H:%M:%S")
| eval e_time=strftime(earliest_time,"%m/%d/%y %H:%M:%S")
| eval time_since_last = latest_time - earliest_time
| fieldformat time_since_last = tostring(time_since_last, "duration")
| join namespace
    [source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s 
    | eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]

Re: Why do I get a 400 stanza error when using a join command in searches?

richgalloway — Thu, 23 Aug 2018 17:33:06 GMT

Try adding the search command to the join.

... | join namespace
     [search source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s 
     | eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]

Re: Why do I get a 400 stanza error when using a join command in searches?

inventsekar — Fri, 24 Aug 2018 05:52:07 GMT

i hope this issue is not related to join command..
In the middle of the SPL, we can not have this [source=abc .... ],

with a search command, it will become a complete SPL..

join namespace [source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s | eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]

Re: Why do I get a 400 stanza error when using a join command in searches?

inventsekar — Fri, 24 Aug 2018 05:52:20 GMT

i hope this issue is not related to join command..
In the middle of the SPL, we can not have this [source=abc .... ],

with a search command, it will become a complete SPL..

join namespace [source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s | eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]

Re: Why do I get a 400 stanza error when using a join command in searches?

richgalloway — Fri, 24 Aug 2018 18:50:22 GMT

Searches/subsearches need to start with a command. "source" is not a command, but search is. There is an implicit search at the beginning of every query, but not in subsearches.