How do I split the output of the join in Splunk

arungeorge09 — Mon, 07 Sep 2015 07:01:56 GMT

I have a splunk join between a synchornous event and an asynchornous event. The only join condition between these are just a correlation id. I am able to get the join but I want to now know what are the actual reason which caused it and would like to see the part of a join . How do I do that.

index=xyz platform=apns batch=496 event="NEAT-IN"  | join type=outer alertId [ search index=xyz event=cloudPns*  ] | stats count by responseCode

Now if the responseCode is 8 then I have a problem but I want to see all the events with event=cloudPns* alone for this join condition .

I tried where but it gave me 0 results.
what I tried is this:

index=qa-speed platform=apns batch=496 event="NEAT-IN"  | join type=outer alertId [ search index=qa-speed event=cloudPns*  ] |search where event=cloudPns*

How do I achieve this . I basically want to see the output of the right part of the join.

Re: How do I split the output of the join in Splunk

lquinn — Mon, 07 Sep 2015 13:49:25 GMT

Using the join command will literally join events together so you cannot then search only for part of an event. If you wanted to return the raw event from the righthand join you could maybe rename the _raw field before the join and then table it like this:

 index=qa-speed platform=apns batch=496 event="NEAT-IN"  | join type=outer alertId [ search index=qa-speed event=cloudPns* | rename _raw AS rawEvent ] | table rawEvent

topic How do I split the output of the join in Splunk in Splunk Search

How do I split the output of the join in Splunk

Re: How do I split the output of the join in Splunk