topic Re: How to replace join from the below query? in Splunk Search

How to replace join from the below query?

pstalin_ — Thu, 03 Dec 2020 07:50:37 GMT

index=105261-cli sourcetype=show_system_resources
| dedup deviceId
| eval nexus_percent_used=round(100*memory_used/memory_total)
| eval nexus_status=if(nexus_percent_used>85, "Not OK", "OK")
| fields deviceId, nexus_percent_used, nexus_status
| append
[ search index=105261-cli sourcetype=show_memory_statistics
| dedup deviceId
| eval ios_percent_used=round(100*used/total)
| eval ios_status=if(ios_percent_used>85, "Not OK", "OK")
| fields deviceId, ios_percent_used, ios_status ]
| join deviceId
[ search index=105261-np sourcetype=device_details
| fields deviceId, productFamily, swVersion, deviceName ]
| eval percent_used=if(like(productFamily, "%Nexus%"), nexus_percent_used, ios_percent_used)
| eval status=if(like(productFamily, "%Nexus%"), nexus_status, ios_status)
| table deviceName, productFamily, swVersion, percent_used, status
| sort -percent_used

Re: How to replace join from the below query?

bowesmana — Thu, 03 Dec 2020 07:57:05 GMT

Did you see my reply to your other similar question https://community.splunk.com/t5/Splunk-Search/How-to-replace-join-command-with-any-other-alternative-command/m-p/531807#M150218

The same principle would apply to this search also.

Re: Hi I have replaced like this, but I'm getting different output

pstalin_ — Thu, 03 Dec 2020 11:29:11 GMT

(index=148031-cli sourcetype=show_system_resources) OR (index=14031-cli sourcetype=show_memory_statistics) OR (index=148031-np sourcetype=device_details)
|fields deviceId,memory_used,memory_total,used,total,productFamily, swVersion, deviceName
| stats latest(*) as * by deviceId
| eval nexus_percent_used=round(100*memory_used/memory_total)
| eval nexus_status=if(nexus_percent_used > 85, "Not OK", "OK")
| eval ios_percent_used=round(100*used/total)
| eval ios_status=if(ios_percent_used > 85, "Not OK", "OK")
| eval percent_used=if(like(productFamily, "%Nexus%"), nexus_percent_used, ios_percent_used)
| eval status=if(like(productFamily, "%Nexus%"), nexus_status, ios_status)
| table deviceName, productFamily, swVersion, percent_used, status
| sort -percent_used

Re: Hi I have replaced like this, but I'm getting different output

pstalin_ — Sat, 05 Dec 2020 05:08:48 GMT

@bowesmana Hi I have tried the query as u said before but still I'm not getting the exact events count as I got when I used join. Could you please help me in solving this?

Re: Hi I have replaced like this, but I'm getting different output

bowesmana — Sun, 06 Dec 2020 23:01:39 GMT

You will need to give an example of the data and some outcomes of the searches otherwise it's hard to diagnose the query