topic Re: Can anyone suggest how I can create a join query using pattern in Splunk Search

Can anyone suggest how I can create a join query using pattern

ayush8878 — Fri, 29 Nov 2019 10:30:02 GMT

Eg
eg in fuse.log I have a entry like userId=abc
while in access.log i have entry like sessionid-12232 | abc | xyz
Output I want is like
abc | xyz | sessionid-12232
Can you please suggest how can i join these two using pattern

Re: Can anyone suggest how I can create a join query using pattern

richgalloway — Sat, 30 Nov 2019 04:27:19 GMT

Assuming access.log has fields 'sessionid', 'userid', and 'foo' and they're already extracted then this should get you started.

source=fuse.log OR source=access.log | stats values(*) as * by userid | table userid foo sessionid

Re: Can anyone suggest how I can create a join query using pattern

ayush8878 — Sat, 30 Nov 2019 10:07:00 GMT

hey, Thank you very much for the response but the scenario is little different
in fuse.log I have fields like
userId=abc | session=123 | time=12:00 IST
so splunk is able to concider then as 3 fields i.e. userId,session,time
while in access.log i only have values but not field name i.e
foo-abc-12:00 IST-data
What I need to achieve is get the userid from fuse.log and find that id in access.log and print userid |session | data

Re: Can anyone suggest how I can create a join query using pattern

to4kawa — Sat, 30 Nov 2019 10:43:41 GMT

| makeresults
| eval _raw="userId=abc,session=123,time=12:00_IST"
| kv
| eval time=replace(time,"_"," ")
| append 
    [| makeresults 
    | eval _raw="foo-abc-12:00 IST-data" ]
`comment("this is sample data")`
| rex "(?<user>[^\-]+)-(?<userId>[^\-]+)-(?<time>[^\-]+)-(?<data>.+)"
| stats values(*) as * by userId 
| eval session="sessionid-".session
| table userId user session

I uased @richgalloway 's query, thanks.

 source=fuse.log OR source=access.log 
| rex "(?<user>[^\-]+)-(?<userId>[^\-]+)-(?<time>[^\-]+)-(?<data>.+)"
| stats values(*) as * by userid 
| eval session="sessionid-".session
| table userid user sessionid

How about this?

Re: Can anyone suggest how I can create a join query using pattern

richgalloway — Sat, 30 Nov 2019 12:50:47 GMT

This information should have been included in the question.
@to4kawa's answer should do the job.

Re: Can anyone suggest how I can create a join query using pattern

ayush8878 — Mon, 02 Dec 2019 16:58:44 GMT

Thanks @richgalloway @to4kawa