Which record does a join function look at

strehb18 — Wed, 13 Sep 2023 16:42:47 GMT

Hello Experts,

I am looking at an alert that is using a join function to match a work_center with a work order. I am wondering what records in a stream of records the join is looking at to get that result? Is there a way to get the latest result.

To explain further, the work center in some cases will change based on where work is being completed, so I would like to grab the latest result when the alert runs.

The current code I am looking at using this give us a way to compare the work center in the source="punch" vs the current stream of data. I am wondering if I can further manipulate that subsearch to look at the last result in source="punch". I tried a couple things but didn't have any luck. Not super familiar with joins in my normal work.

| join cwo type left
[search source=punch
| rename work_center as position]

Re: Which record does a join function look at

gcusello — Thu, 14 Sep 2023 06:47:58 GMT

Hi @strehb18,

if your requirement is to have only the last result and only one event, you could use something like this:

<your_search> | join cwo type left [search source=punch index=your_index | rename work_center as position | sort -_time | head 1 ]

Only one hint: the join command is a very slow command and it consumes many resources; there are usually other solutions to replace the join command, e.g. the stats command, but this depends on your use case.

Ciao.

Giuseppe

topic Which record does a join function look at in Splunk Search

Which record does a join function look at

Re: Which record does a join function look at