topic Re: Join Statment in Splunk Search

Join Statment

hartfoml — Fri, 18 Jan 2013 19:53:09 GMT

OK the last question might have bee to hard for the group. So try this one.

I am using the join statement like this "search1 | join id [search2]"

In the primary search and in the sub-search there is a field called "id" but they do not always match.

I want to join on the field "search1 id=*" to "search2 key=*". "ID" and "KEY" always match.

I tried this but it did not work "search1 | join id:key [search2]"

I tried this but it did not work "search1 | join id,key [search2]"

I tried this to see if it would auto join, no luck "search1 | join [search2]"

Any help would be great.

Re: Join Statment

jonuwz — Fri, 18 Jan 2013 20:29:11 GMT

Sounds like you just need to abstract the different fields into something common you can join on

... | search1 | eval join_field=id | join join_field [ search2 | eval join_field=key ]

Re: Join Statment

hartfoml — Fri, 18 Jan 2013 22:25:06 GMT

you have done it again twice in one day 🙂

Re: Join Statment

fflloovee — Fri, 09 May 2014 03:19:21 GMT

"eval join_field=id" Can i change id to field name because i have many id and want to join by id
i try to use "join type=left ID" and some value are missing(i search each value and see there refernce with id but still missing)