topic Search join with filter in Splunk Search

Search join with filter

erick_costa — Tue, 07 Aug 2012 15:00:17 GMT

I want to do the SQL in Splunk:

SELECT TB1.*
FROM TB1
JOIN TB2
ON TB2.ID = TB1.ID
WHERE TB2.OPTION = "OPTION 1"

How do I do this?

Re: Search join with filter

rroberts — Tue, 07 Aug 2012 15:33:44 GMT

Check out this document!

http://www.innovato.com/splunk/SQLSplunk.html

You might find it helpful.

Re: Search join with filter

sophy — Tue, 07 Aug 2012 16:09:18 GMT

or, here:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk

Re: Search join with filter

rroberts — Tue, 07 Aug 2012 16:11:41 GMT

Even better!

Re: Search join with filter

sideview — Tue, 07 Aug 2012 16:25:36 GMT

Although, in many cases the best thing to do is to not think of it as a join, break it down as a) a disjunction (sourcetype=A some terms) OR (sourcetype=B some other terms) b) a little eval to smooth things out in small ways, c) a stats command to pair everything up in the exact same way a join would. the best practice for advanced splunk developers is really to use lookups or stats or transaction, and only actually use the join command as a last resort.