Don't understand how to use splunk join, want to merge two tables

henriq_c — Tue, 29 Sep 2020 23:44:16 GMT

Hello,

I have this

the result is something like that and it is ok :

host | instance | x

server1 | C: | 30
server1 | 😧 | 20
server1 | E: | 10
server2 | C: | 40

and I have this :

index=myindex eventtype="perfmon_windows" (object="Memory" counter="% Committed Bytes In Use") instance!="_Total"
| stats first(Value) as value by instance, host
| eval y= 100 - round(value,2)
| sort host
| fields host, y

the result is something like that and it is ok :

host | y

server1 | 55
server2 | 34

I tried to join the two search with a join on host and i have that :

host | instance | x | y

server1 | 0 | 30 | 55
server1 | 0 | 20 | 55
server1 | 0 | 10 | 55
server2 | 0 | 40 | 34

But i want to have this :

host | instance | x | y

server1 | C: | 30 | 55
server1 | 😧 | 20 | 55
server1 | E: | 10 | 55
server2 | C: | 40 | 34

Do you have a solution please ?

I dont know if it is my join or other thing to do

Thank you 🙂

Re: Don't understand how to use splunk join, want to merge two tables

whrg — Wed, 20 Mar 2019 17:38:02 GMT

Can you post your join command?

topic Re: Don't understand how to use splunk join, want to merge two tables in Splunk Search

Don't understand how to use splunk join, want to merge two tables

host | instance | x

Re: Don't understand how to use splunk join, want to merge two tables