topic Re: join query not returning result in Splunk Search

join query not returning result

kajolsharma — Thu, 18 Nov 2021 15:21:52 GMT

Hi, I have a query below with a join condition .The issue is if I am hardcoding name value I am getting the result but when I'm removing it, not seeing any results plus I m getting this error in screenshot.

Validated that it is not because of space issue .Can somebody suggest?

Re: join query not returning result

richgalloway — Thu, 18 Nov 2021 15:55:22 GMT

Run each "side" of the join command separately. Verify each returns a field called "name" and that the field has a common value on each side.

Re: join query not returning result

kajolsharma — Thu, 18 Nov 2021 17:08:30 GMT

Yes, we do have name field in both queries. Refer below screenshot:

Re: join query not returning result

richgalloway — Thu, 18 Nov 2021 20:43:14 GMT

That's not the same query. Please run this:

index=batch_monitoring | rex mode=sed field=name "s/ //g"

Re: join query not returning result

kajolsharma — Mon, 22 Nov 2021 10:07:34 GMT

Hi, i have modified the query :

index ="batch_monitoring"|search name=BPSP1060 |rex mode=sed field=name "s/ //g" |table "Activity Name",name,"job name",start,end,status,"Workstation Name _Job"|rename "Workstation Name _Job" as "Workstation"

But still I see no results when i use it with join query .

Re: join query not returning result

richgalloway — Mon, 22 Nov 2021 13:50:44 GMT

Why do you insist on running a query that doesn't match the one in the OP? It doesn't prove anything.

If a query with a join is not returning expected results then it's necessary to run each side of the join independently and without changes. Examine the results of those two queries to ensure they return 1) the expected field(s); 2) the field(s) that will be used to join results; and 3) common values in the joined field(s).

Re: join query not returning result

kajolsharma — Tue, 23 Nov 2021 06:50:26 GMT

Output of first query:

O/p of 2nd query:

You can see I have ran the 2 queries separately in the snips above. And you can find that the searched job result is present in both the results.

o/p of join query:[No result]

o/p of join query by putting a filter on that jobname: [Its shows the result]

I hope you get what I trying to say.