topic Re: Join using multiple source type. But result is still coming blank in Splunk Search

Why are results still coming back blank after using join using multiple source type?

pratibha0610 — Thu, 04 Aug 2022 14:41:32 GMT

Hi team,

I wonder if someone can help me with the below query. I have a to combine my two searches with join. With first search i get the assignement group and with second search i get email of those assigment group to send alert.

i have common values between two sourcetype but field name is different. in the first serach, field is called dv_name and in second it is called name. Therefore i create name variable before using join. However my field email is still coming blank

serach:

index=production sourcetype=call
| eval name=dv_name

| join name type=left

[ index=production sourcetype=mail earliest="04/30/2022:20:00:00" latest=now() | dedup name | stats values (dv_email) values (name) by name]

| eval Email=if(isnull(dv_email), " ", dv_email)

| table dv_name Email

Re: Join using multiple source type. But result is still coming blank

ITWhisperer — Thu, 04 Aug 2022 11:31:37 GMT

Since you are dedup'ing name, there will only be one value (the first) for dv_email so the stats becomes unnecessary. (The reason you were getting no results is that the field created by the stats command is "values(dv_email)" not dv_email - you could fix this (if you still want to use stats) by stats values(dv_email) as dv_email by name.)

Re: Join using multiple source type. But result is still coming blank

pratibha0610 — Thu, 04 Aug 2022 12:02:40 GMT

@ITWhisperer thanks a lot!! my search worked.

I also wanted to check one thing for setting up alert to send mail to Email address popped in result. Will the below solution work?

Enable send email alert action and in to: field set $result.Email$