topic Re: join search with condition in Splunk Search https://community.splunk.com/t5/Splunk-Search/join-search-with-condition/m-p/542373#M153645 <P>Updated my answer check now.</P> Thu, 04 Mar 2021 15:19:23 GMT manjunathmeti 2021-03-04T15:19:23Z join search with condition https://community.splunk.com/t5/Splunk-Search/join-search-with-condition/m-p/542339#M153631 <P>I have two searches:<BR />search-A gives values like<BR />&nbsp;</P><TABLE width="617"><TBODY><TR><TD width="85">type</TD><TD width="95">status</TD><TD width="117">hostname</TD><TD width="64">id</TD><TD width="64">port</TD><TD width="64">Size</TD><TD width="64">base</TD><TD width="64">cache</TD></TR><TR><TD>http</TD><TD>OFF</TD><TD>host-1</TD><TD>17</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>http</TD><TD>ON</TD><TD>host-1</TD><TD>6</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>http</TD><TD>ON</TD><TD>host-1</TD><TD>15</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>http</TD><TD>OFF</TD><TD>host-1</TD><TD>1</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>web</TD><TD>OFF</TD><TD>host-2</TD><TD>17</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>web</TD><TD>ON</TD><TD>host-2</TD><TD>6</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>http</TD><TD>ON</TD><TD>host-3</TD><TD>15</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>http</TD><TD>OFF</TD><TD>host-3</TD><TD>1</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Search-B gives value like</P><TABLE width="617"><TBODY><TR><TD width="85">type</TD><TD width="95">status</TD><TD width="117">hostname</TD><TD width="64">id</TD><TD width="64">port</TD><TD width="64">Size</TD><TD width="64">base</TD><TD width="64">cache</TD></TR><TR><TD>available</TD><TD>not_processed</TD><TD>host-1</TD><TD>17</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>available</TD><TD>not_processed</TD><TD>host-2</TD><TD>17</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>available</TD><TD>not_processed</TD><TD>host-4</TD><TD>15</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>available</TD><TD>not_processed</TD><TD>host-5</TD><TD>1</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>I want to merge two search in such a way that it can check hostname in search-B and if hostname is present in search-A the it should not join/merge that row.. the result should be something like below...</P><TABLE width="617"><TBODY><TR><TD width="85">type</TD><TD width="95">status</TD><TD width="117">hostname</TD><TD width="64">id</TD><TD width="64">port</TD><TD width="64">Size</TD><TD width="64">base</TD><TD width="64">cache</TD></TR><TR><TD>http</TD><TD>OFF</TD><TD>host-1</TD><TD>17</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>http</TD><TD>ON</TD><TD>host-1</TD><TD>6</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>http</TD><TD>ON</TD><TD>host-1</TD><TD>15</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>http</TD><TD>OFF</TD><TD>host-1</TD><TD>1</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>web</TD><TD>OFF</TD><TD>host-2</TD><TD>17</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>web</TD><TD>ON</TD><TD>host-2</TD><TD>6</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>http</TD><TD>ON</TD><TD>host-3</TD><TD>15</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>http</TD><TD>OFF</TD><TD>host-3</TD><TD>1</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>available</TD><TD>not_processed</TD><TD>host-4</TD><TD>15</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR><TR><TD>available</TD><TD>not_processed</TD><TD>host-5</TD><TD>1</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD><TD>NA</TD></TR></TBODY></TABLE><P><BR /><BR /><BR /></P> Thu, 04 Mar 2021 12:13:47 GMT https://community.splunk.com/t5/Splunk-Search/join-search-with-condition/m-p/542339#M153631 arandy01 2021-03-04T12:13:47Z Re: join search with condition https://community.splunk.com/t5/Splunk-Search/join-search-with-condition/m-p/542341#M153633 <P>hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/232118">@arandy01</a>,<BR />Try this:</P><P>&nbsp;</P><LI-CODE lang="markup">search-A | append [search search-B] | eventstats count(eval(status IN("ON", "OFF"))) as status_count by hostname | where NOT (status_count!=0 AND status="not_processed")</LI-CODE><P>&nbsp;</P> Thu, 04 Mar 2021 15:19:03 GMT https://community.splunk.com/t5/Splunk-Search/join-search-with-condition/m-p/542341#M153633 manjunathmeti 2021-03-04T15:19:03Z Re: join search with condition https://community.splunk.com/t5/Splunk-Search/join-search-with-condition/m-p/542348#M153638 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/129090">@manjunathmeti</a>&nbsp;<BR />Thanks for the quick reply...<BR />But it does not work... and only shows results from search-A</P> Thu, 04 Mar 2021 13:27:17 GMT https://community.splunk.com/t5/Splunk-Search/join-search-with-condition/m-p/542348#M153638 arandy01 2021-03-04T13:27:17Z Re: join search with condition https://community.splunk.com/t5/Splunk-Search/join-search-with-condition/m-p/542373#M153645 <P>Updated my answer check now.</P> Thu, 04 Mar 2021 15:19:23 GMT https://community.splunk.com/t5/Splunk-Search/join-search-with-condition/m-p/542373#M153645 manjunathmeti 2021-03-04T15:19:23Z Re: join search with condition https://community.splunk.com/t5/Splunk-Search/join-search-with-condition/m-p/542439#M153655 <P>Thanks a lot <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR />works perfectly <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 05 Mar 2021 03:21:46 GMT https://community.splunk.com/t5/Splunk-Search/join-search-with-condition/m-p/542439#M153655 arandy01 2021-03-05T03:21:46Z