topic Re: Outer Join not working in Splunk Search

Outer Join not working

robertlynch2020 — Wed, 30 Sep 2020 04:02:55 GMT

I have data in a CSV called 25_million_Linie_Rule.csv (example below)

host,source,count
"INTERFACES_BUILD","/hp547srv1/apps/INTERFACES_BUILD/logs/traces/mxtiming_956675_hp547srv.fr.murex.com_**1254**.log",31436700

I also have data in real time.
If the data in rela time is the same as the .csv i don'twant to report it . So an outer join is needed, but i cant get it to work.

| tstats count where index="mlc_live" OR index="mxtiming_live" by host source 
| dedup source 
| sort 0 - count 
| head 10 
| where count > 25000000 
| table host source count 
| join type=outer source  
    [| inputlookup 25_million_Linie_Rule.csv  ]

OUTPUT is below (However i get a line i already have in the csv, i should only get one line, the new line not the one i have in the .csv )

host    source  count
INTERFACES_BUILD    /hp547srv1/apps/INTERFACES_BUILD/logs/traces/mxtiming_956675_hp547srv.fr.murex.com_**1254**.log 31436700
INTERFACES_BUILD    /hp547srv1/apps/INTERFACES_BUILD/logs/traces/mxtiming_956678_hp547srv.fr.murex.com_**1992**.log 26617140

Any help would be great
Rob

Re: Outer Join not working

13tsavage — Wed, 05 Feb 2020 20:08:10 GMT

I think the join is working as intended. Because the same event that lives in your 25_million_Linie_Rule.csv also would be found in your real-time main search. Doing the join should not remove events found in your main search that match those events in your 25_million_Linie_Rule.csv as I think you want.

Re: Outer Join not working

to4kawa — Wed, 05 Feb 2020 20:47:16 GMT

 | tstats count where index="mlc_live" OR index="mxtiming_live" by host source 
 | dedup source 
 | sort 0 - count 
 | head 10 
 | where count > 25000000 
 | table host source count 
 | join type=outer source  
     [| inputlookup 25_million_Linie_Rule.csv 
       | eval  csv=1]
 | where isnull(csv)
 | table host source count

Re: Outer Join not working

robertlynch2020 — Thu, 06 Feb 2020 18:06:26 GMT

Thanks for the replay,

but i get

Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.

Re: Outer Join not working

to4kawa — Thu, 06 Feb 2020 23:28:50 GMT

sorry, @robertlynch2020
I forgot to erase it. my answer is updated.

Re: Outer Join not working

robertlynch2020 — Mon, 10 Feb 2020 10:35:31 GMT

Brill - thanks 🙂