How do I join on a specific field?

slatta — Tue, 29 Sep 2020 07:52:42 GMT

I have many events, but only want to select those that have the same docId in order to compare the Durations of 2 different viewers.

Sample Data:

Viewer=viewer1, docId=12345, Duration=1204
Viewer=viewer2, docId=12345, Duration=998
Viewer=viewer1, docId=42543, Duration=1411
Viewer=viewer1, docId=98322, Duration=1502
Viewer=viewer2, docId=77777, Duration=1256
....

Expected Output (only get docId, durations that has been viewed by both viewer1 and viewer2, e.g. docId=12345):

docId, Viewer1_Duration, Viewer2_Duration
12345, 1204, 998

Re: How do I join on a specific field?

aholzer — Mon, 16 Nov 2015 20:14:08 GMT

To join the data, you just need to use a join

<base search> Viewer=viewer1 | join docId [search <base search> Viewer=viewer2]

This should get you the join. If you want the two durations distinguished though, you should rename the duration fields to something else before the join

<base search> Viewer=viewer1 | rename Duration AS Viewer1_Duration | join docId [search <base search> Viewer=viewer2 | rename Duration AS Viewer2_Duration ]

Hope this helps

topic How do I join on a specific field? in Splunk Search

How do I join on a specific field?

Re: How do I join on a specific field?