Join Earlier Joins with Later

grex2595 — Fri, 07 Dec 2018 23:03:52 GMT

I'm doing a join where I want to only get subsearch events that happened before the parent search event. Thus, I'm using:

txnEnd | spath output=custID path=path | join custID [search txnStart | spath output=amount path=path] | table custID, amount

Since txnEnd comes after txnStart , I'm using join's default usetime=true earlier=true. Whether or not I explicitly state these values, I am getting records on the table where txnStart happens after txnEnd (tested by getting the _time of each event and displaying the difference between them).

Why doesn't Splunk only join on the earlier events? What can I do to make it so that txnEnd will only join with events from txnStart that happened before txnEnd ?

Edit

I thought I might mention that the same custID applies to multiple txnEnds and multiple txnStarts. The two events do not have a unique ID that will tie them together, so I have to determine which txnStart belongs to txnEnd based off of which txnStart with the same custID happened the most recently before txnEnd.

Re: Join Earlier Joins with Later

nagarjuna280 — Sat, 08 Dec 2018 17:53:47 GMT

First group all events together, don't use joins.

Pull transaction start and end, If you have these two events in different index OR sourcetypes, then append transaction start events to end using append command

| transaction custID startswith="something which is in transction start events" endwith="something which is in transction end events"

go through Transaction command in Splunk doc, you get to know how to use this command

topic Re: Join Earlier Joins with Later in Splunk Search

Join Earlier Joins with Later

Re: Join Earlier Joins with Later