topic Re: multifield key between indexes in Splunk Search

multifield key between indexes

kp_pl — Sat, 06 Jul 2024 12:09:01 GMT

index=db OR index=app | eval join=if(index="db",processId,pid) | stats sum(rows) sum(cputime) by join

Above is simple example how to join two indexes. But how to join two indexes where the key value has two fields ?

K.

Re: multifield key between indexes

gcusello — Fri, 05 Jul 2024 07:11:41 GMT

Hi @kp_pl ,

yes, it's correct.

I'd use coalesce instead if:

index IN (db, app) | eval key=coaesce(processId,pid) | stats sum(rows) AS rown sum(cputime) AS cputime by key

Ciao.

Giuseppe

Re: multifield key between indexes

kp_pl — Fri, 05 Jul 2024 12:22:37 GMT

I suppose you do not understand my question .

I need a join two indexes by two fields , Something like

| eval key=if(index="aaa", I1key1 , I2key1) | eval key2=if(index="aaa", I1key2 , I2key2) | stats values(*) as * by (key and key2)

Re: multifield key between indexes

gcusello — Fri, 05 Jul 2024 08:06:12 GMT

Hi @kp_pl ,

I understood that you have key1 in ndex1 and key2 in index2 and you want to correate events from both the indexes.

using coalesce, you create a new field (caed key) that takes values from index1 (when present key1) or otherwise from index2 (key2).

then you correlate values using stats and you have values from both the indexes.

Ciao.

Giuseppe

Re: multifield key between indexes

kp_pl — Fri, 05 Jul 2024 12:24:22 GMT

everything you write is correct but it is not my case.
Below my indexes with keys:
index1: AAA
key values: fieldA1 AND fieldA2

index2 : BBB
key values: fieldB1 AND fieldB2

so I suppose I need to do something like

| eval JOIN=if (index='AAA', fieldA1+"_"+fieldA2, fieldB1+"_"+fieldB2)

or in your way:

| eval key=coalesce(fieldA1+"_"+fieldA2 , fieldB1+"_"+fieldB2)

btw. In a few sources close to splunk I read IF is more efficient than COALESCE . But of course both methods do more or less the same.

Re: multifield key between indexes

gcusello — Fri, 05 Jul 2024 08:42:38 GMT

Hi @kp_pl ,

yes, coalesce and if are the same, even if I always use coalesce.

I usually use "." instead "+".

let me summarize: for events from index A, you want to use to concatenated fields from this index, otherwise

two concatenated fieds from index B, is it correct?

in this case you could use:

| eval key=coalesce(fieldA1."_".fieldA2, fieldB1."_".fieldB2)

or in your way:

| eval JOIN=if(index="AAA", fieldA1."_".fieldA2, fieldB1."_".fieldB2)

let me know.

Ciao.

Giuseppe