Help with union not working

sarit_s — Thu, 16 Jun 2022 18:23:01 GMT

Hello

I'm running this query:

| union [ search host="puppet-01" OR host="jenkins-01" OR host="ANSIBLE-01" sourcetype=ProductionDeploy NOT Permisson_Job_Name=*_permission Environment=PRODUCTION | table _time, App_Name, User, Change_Log_Description, Environment, Version] [ search sourcetype=mscs:storage:blob:json | rex field=_raw "Details\":\"(?<Details>.*?)\"," | rex field=_raw "ProjectName\":\"(?<ProjectName>.*?)\"," | rex field=_raw "ScopeDisplayName\":\"(?<ScopeDisplayName>.*?)\"," | rex field=_raw "releaseName\":\"(?<releaseName>.*?)\"}" | rex field=_raw "ActionId\":\"(?<ActionId>Release.ReleaseCreated)\"," | rex field=_raw "ActorUPN\":\"(?<ActorUPN>.*?)\"," | rex field=_raw "DeploymentResult\":\"(?<DeploymentResult>.*?)\"," | rex field=_raw "PipelineName\":\"(?<PipelineName>.*?)\"," | where releaseName != null AND PipelineName like "%Production" | rename ProjectName AS App_Name | rename ActorUPN AS User | rename releaseName AS Change_Log_Description | rename PipelineName AS Environment | rename DeploymentResult AS status | table _time, App_Name, User, Change_Log_Description, Environment, Version,status] | sort -_time asc

and im trying to get the status
at the first search i don't have this value but i do have it at the second one
i don't see status column at my results.

can someone explain me why ?

thanks

Re: union not working

ITWhisperer — Thu, 16 Jun 2022 11:38:56 GMT

Try your where command like this

| where isnotnull(releaseName) AND PipelineName like "%Production"

Re: union not working

sarit_s — Thu, 16 Jun 2022 11:44:56 GMT

still the same

Re: union not working

ITWhisperer — Thu, 16 Jun 2022 11:58:52 GMT

Does this rex match your events?

| rex field=_raw "DeploymentResult\":\"(?<DeploymentResult>.*?)\","

Re: union not working

sarit_s — Sun, 19 Jun 2022 07:55:57 GMT

yes it does

the problem is the since i don't have the field status at the first search i don't get the results of the second one

maybe the union not fit here ?

topic Re: union not working in Splunk Search

Help with union not working

Re: union not working

Re: union not working

Re: union not working

Re: union not working