topic Re: how to replace join? in Splunk Search

how to replace join?

priyastalin — Fri, 18 Dec 2020 13:15:16 GMT

Hi, @493669 @MuS @dturnbull_splun @bowesmana

Anyone please help me in replacing join in the below query??

Thanks

Re: how to replace join?

to4kawa — Mon, 21 Dec 2020 21:20:08 GMT

fixed sample:

(index=167515-np sourcetype=hardware physicalType=Chassis) OR (index=167515-np [| `last_np_sourcetype( "index=167515-np", "group_members")` ] groupId=288348 ) | fields deviceId, productType, productId, physicalType, sourcetype | stats values(*) as * dc(sourcetype) as flag by deviceId | where flag > 1 | stats dc(productId) as PIDs by productType | search productType=Routers | table PIDs

Re: how to replace join?

priyastalin — Mon, 21 Dec 2020 06:49:00 GMT

Hi @to4kawa ,

I didn't get output for this, Could you please help me in solving this?

Re: how to replace join?

to4kawa — Mon, 21 Dec 2020 09:50:46 GMT

I made a mistake and fixed it.

Re: how to replace join?

priyastalin — Mon, 21 Dec 2020 12:03:08 GMT

Hi @to4kawa ,

Couldn't see your solution can you send me again?

Thanks