topic Re: Join Query in Splunk Search

Join Query

chuck_life09 — Mon, 20 Dec 2021 13:18:26 GMT

I have an Index B which has job_name and job_status details and another index A which has ticket number and job_name...

Index A to be joined with Index B to get the below details

ticket_number,job_name and job_status

I tried join type= inner job_name based on job_name
but i get empty results for job_status

what might be going wrong?

richgalloway — Mon, 20 Dec 2021 17:43:23 GMT

Please share the full query.

chuck_life09 — Mon, 20 Dec 2021 17:59:14 GMT

The sample query with index details as below.

Index A

ticket number , job name

Index B

Job Name,Status

Query :-

index=A
| table ticket_number,job_name
| join type=left job_name
[search index=B
| table Job_Name, Status
|rename Job_Name as "job_name"
]

richgalloway — Mon, 20 Dec 2021 18:38:47 GMT

That query looks like it should work fine. Just make sure the field names are exactly as they appear in the indexes.

If you still have trouble getting it to work, try this alternative query.

(index=A ticket_number=* job_name=*) OR (index=B Job_Name=*) | rename Job_Name as job_name | stats values(*) as * by job_name