topic Re: need help with joining two queries in Splunk Search

need help with joining two queries

pench2k19 — Wed, 30 Sep 2020 00:27:55 GMT

Hi ninjas,

i have two queries with ] the output as follows

query1 output fields:

SOR filename expected_time
1ci extract 12:30:00 10-5-2019

query2 output fields:
SOR ** filename** real_time
1art congig 01:30:00 10-5-2019

The second query values are subset of first query.

Now i want to print the values of SOR , filename and expected_time when there is no real_time value in the second query.

can you please help here.

@jkat54 @vnravikumar @somesoni2 @woodcock

Re: need help with joining two queries

koshyk — Fri, 10 May 2019 06:22:23 GMT

I'm not clear on your query, if you need a lookup or join or transaction between the queries

Just a guess, Is this what you are expecting? The below should print fields irrespective of and if SOR is both the same, it will print the join

<query1> 
| join type=left SOR [|<query2>]

Re: need help with joining two queries

MuS — Fri, 10 May 2019 06:33:39 GMT

Hi pench2k19,

best option is to forget about join completely for reasons.

Just use a plain stats instead:

 query1 OR query2 | stats values(*) AS * by SOR

this works best, and you will not hit any hidden limits 😉

Learn more over here https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html

cheers, MuS

Re: need help with joining two queries

pench2k19 — Fri, 10 May 2019 07:08:23 GMT

Hi @MuS

Thanks for the reply.

Unfortunately your solution is not working in my case.

Re: need help with joining two queries

MuS — Fri, 10 May 2019 07:09:40 GMT

I'm pretty sure it would if you could provide more context, and some sample events 😉

Re: need help with joining two queries

pench2k19 — Fri, 10 May 2019 07:10:50 GMT

Hi @MuS

Thanks for the response.

It's not working unfortunately.

Let me tell the clear requirement here... I need the SOR, Filename, expected_time values when there is no arrival time. Can you please suggest me the alternative way

Unfortunately I m not able copy my query here.

Re: need help with joining two queries

pench2k19 — Fri, 10 May 2019 07:13:59 GMT

To give you more context, in the first query I have loopkup file as data source and in the second query I mean using real time logs.

Re: need help with joining two queries

woodcock — Fri, 10 May 2019 13:41:26 GMT

I cannot help unless you show us the 2 searches (the SPL).