topic Re: Adding a column from a subsearch in Splunk Search

Adding a column from a subsearch

hatbeard — Wed, 07 Mar 2018 20:53:46 GMT

I have this query that i've lightly changed from the winfra app, but i want to add a PID into it, that would be in the second query. I'm having trouble figuring out how to get this done.

eventtype="perfmon_windows" (Host="SERVER" ) Host="*" object="Process" counter="% Processor Time" instance="coldfusion*" AND NOT instance="coldfusions*"  | stats sparkline(avg(Value)) as Trend avg(Value) as Average, max(Value) as Peak, latest(Value) as Current, latest(_time) as "Last Updated" by instance | convert ctime("Last Updated") | sort - Current | eval Average=round(Average, 2) | eval Peak=round(Peak, 2) | eval Current=round(Current, 2)

then there's this one, which has the value of the PID

eventtype="perfmon_windows" (Host="SERVER" ) object="Process" instance="coldfusion*" AND NOT instance="coldfusions*"  counter="ID Process" |table Value

When I use a JOIN i get far too many columns back.

Re: Adding a column from a subsearch

kamal_jagga — Tue, 29 Sep 2020 18:20:17 GMT

There should be 1 field common in both the queries to combine the values.

Your first query doesn't have "value" field being carried in the final results.

Re: Adding a column from a subsearch

hatbeard — Wed, 07 Mar 2018 21:34:40 GMT

The instance field is common between them. They're similar searches, just on different objects.

Re: Adding a column from a subsearch

kamal_jagga — Mon, 19 Mar 2018 20:41:39 GMT