topic Re: Add field from the returns of another query in Splunk Search

Add field from the returns of another query

yk010123 — Fri, 08 Oct 2021 00:25:59 GMT

I am trying to produce the following output :

app_name	request_id	time	workload at the time(requests per second)
App1	123	1000	?
App2	1234	1000	?

I have two queries that return :

1. A table with the requests taking the most time

app_name	request_id	time
app1	1	1000

2. Numeric value that returns the requests per second for a given app

app_name	requests per second
app1	10

How can I join the results from two different queries to produce the final table above?

Thank you!

Re: Add field from the returns of another query

ITWhisperer — Fri, 08 Oct 2021 04:12:43 GMT

From your simplistic description, all I can suggest is:

search 1 | join app_name [search 2]

If this doesn't work, you will need to provide more detail of what you are actually doing

Re: Add field from the returns of another query

yk010123 — Fri, 08 Oct 2021 14:23:21 GMT

This is what I tried but that does not return any result:

index=myIndex method!=GET process="end" | join app_name [search index=myIndex method!=GET process="start" | timechart count by app_name | timechart per_second(*) ]
| table _time app_name request_id

Re: Add field from the returns of another query

ITWhisperer — Fri, 08 Oct 2021 14:43:57 GMT

Try something like this

Re: Add field from the returns of another query

yk010123 — Fri, 08 Oct 2021 15:57:47 GMT

Thank you for the suggestion. I tried that but it returned :

[subsearch]: The specified span would result in too many (>50000) rows.

And no results. It seems that the only way it works is if I run it in a smaller time range (the individual queries work fine under a longer range)

Perhaps we could group the requests per second over a longer timeframe (for example, report of the last n minutes) is that possible?

Also, in some instances, the requests per second field is returning 0 which does not make any sense. Is there some rounding going on?

Also, if possible, could you please break down the query so that I understand your reasoning?

Thank you again!