topic Join with condition OR in Splunk Search

Join with condition OR

gibba — Tue, 11 Apr 2017 09:59:43 GMT

Hi Everyone

i need to use a splunk join,

i want ask is possible use two field with OR condition

Example

my search | fields column 1, column 2, column 3 | join cloumn 1 OR column 2 [ my second search]

thank you
For your time

Re: Join with condition OR

gcusello — Tue, 11 Apr 2017 10:11:00 GMT

Hi gibba,
no you cannot use an OR condition in a join.
What's the problem values in column1 and column2?
if this is the problem you could use an eval with coalesce function

my search 
| eval column=coalesce(column1,column2) 
| join column [ my second search]

Bye.
Giuseppe

Re: Join with condition OR

gibba — Tue, 11 Apr 2017 10:42:14 GMT

Ciao Giuseppe

i try to use olny one column beacause the second sometimes is null but i can't use coalesce beacuase i need column 2= null

thank for your time

Re: Join with condition OR

woodcock — Tue, 11 Apr 2017 13:55:45 GMT

Skip join entirely (it has inescapable limits) and do this

my saearch OR my second search | eval joiner=coalesce(column1, column2) | stats values(*) AS* BY joiner | fields - joiner

Just try it before you think it won't work.