topic How do I join a search with a list of jobnames from a file DepC_listofjobs.csv? in Splunk Search

How do I join a search with a list of jobnames from a file DepC_listofjobs.csv?

mihir_hardas — Thu, 10 Nov 2022 15:44:42 GMT

How do I join a search with a list of jobnames from a file DepC_listofjobs.csv. This file has only one column which has unique jobnames.

Below command, if I uncomment the line

earliest=-8h index=log-13120-prod-c laas_appId="pbmp.prediction*" "Prediction"

```| join [ inputlookup DepC_listofjobs.csv ]```

| bin _time span=1h

| stats dc(predictionId),dc(jobName), count by _time predictionStatus

Re: equijoin join search with a lookupfile

starcher — Thu, 10 Nov 2022 12:28:44 GMT

Why are you joining instead of just not using the lookup as a lookup?

Re: equijoin join search with a lookupfile

mihir_hardas — Thu, 10 Nov 2022 13:12:03 GMT

I need to expliticity use a join+subsearch because below SPL gives no rows returned

earliest=-8h index=log-13120-prod-c laas_appId="pbmp.prediction*" "Prediction"

| join [ inputlookup DepC_listofjobs.csv ]

| bin _time span=1h

| stats dc(predictionId),dc(jobName), count by _time predictionStatus

sample event in the index is pasted below

2022-11-10 00:18:20.353 [task-25483] INFO c.m.b.p.s.p.PredictionRunner#lambda$run$2 - predictionId=e5e2a703-13c6-4c15-addc-9f2c114733ec, job=PADT-HUB-P-D-G-RS-PTY-ADDR-DLT-INS^PNA predicted as Prediction(predictionId=e5e2a703-13c6-4c15-addc-9f2c114733ec, jobName=PADT-HUB-P-D-G-RS-PTY-ADDR-DLT-INS, instance=PNA, predictionStatus=PREDICTED, predictedStartTime=1668067804, predictedFinishTime=1668067880, predictionExplanation=PREDICTED, predictedAt=1668057500)

Re: equijoin join search with a lookupfile

mihir_hardas — Thu, 10 Nov 2022 13:22:48 GMT

The below SPL works but gives very less data than expected

earliest=-2d index=log-13120-prod-c laas_appId="pbmp.prediction*" "Prediction"
| rename jobName as jobname

| join [ inputlookup DepC_listofjobs.csv ]

| bin _time span=1h

| stats dc(predictionId),dc(jobname), count by _time predictionStatus