topic Re: Why am I not able to join my search? in Splunk Search

Why am I not able to join my search?

splunker9999 — Thu, 14 Jul 2016 17:32:06 GMT

Hi,

Why we are not able to join my search? Can you please suggest how to edit this?

index=idx* sourcetype=Uptime host="*bd*" SystemUpTime>300
| eval difference=(_time - SystemUpTime)
| eval c_time=strftime(difference,"%Y-%m-%d %H:%M:%S")
|join host [search index=idx2_* sourcetype=ps1 |dedup host ]|table host c_time cluster

Re: Why am I not able to join my search?

sundareshr — Thu, 14 Jul 2016 17:37:37 GMT

Try selfjoin

index=idx* sourcetype=Uptime host="*bd*" SystemUpTime>300
 | eval difference=(_time - SystemUpTime)
 | eval c_time=strftime(difference,"%Y-%m-%d %H:%M:%S")
 |selfjoin host [search index=idx2_* sourcetype=ps1 |dedup host ]|table host c_time cluster

Re: Why am I not able to join my search?

splunker9999 — Thu, 14 Jul 2016 17:44:55 GMT

Is there any other we can join this, join taking long time to give results.?

Re: Why am I not able to join my search?

sundareshr — Thu, 14 Jul 2016 17:54:47 GMT

I would recommed a two-part search.

1) Create a lookup table OR kvstore, with only the hosts from your subsearch. Like this

index=idx2_* sourcetype=ps1 |dedup host | table host cluster | outputlookup hostlist.csv

You can schedule this to run at a certain frequency (how often do you add new hosts). You can the use this lookup to append cluster info, like this. You could also add the cluster info as an automatic lookup

index=idx* sourcetype=Uptime host="*bd*" SystemUpTime>300
  | eval difference=(_time - SystemUpTime)
  | eval c_time=strftime(difference,"%Y-%m-%d %H:%M:%S")
  | lookup hostlist.csv host OUTPUT cluster 
  | table host cluster

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Outputlookup
http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Lookup