Can Splunk Join between 2 Unions?

[royimad]

I have 2 searches with set union and i need to join between those 2 results on a specific column (origine)
can i join between 2 set union search ,if yes how?

Search 1:
| set union [search sourcetype="log4j" | rex field=source "/././(?.)_(?.)(?.).log"
| stats count by SEVERITY_WEBAPP, origine
| where SEVERITY_WEBAPP="ERROR" OR SEVERITY_WEBAPP="FATAL" OR SEVERITY_WEBAPP="WARN" | rename SEVERITY_WEBAPP as SEVERITY]
[search source="/home/splunk/app4_error_core.log" | rex field=source "/././(?.)(?.)_(?.).log" | stats count by SEVERITY_CORE , origine
| where SEVERITY_CORE="ERROR" OR SEVERITY_CORE="FATAL" OR SEVERITY_CORE="WARN" | rename SEVERITY_CORE as SEVERITY ]

Search 2:
| set union [search sourcetype="log4j" | rex field=source "/././(?.)_(?.)(?.).log"
| top limit=1 COMPONENTS_WEB by SEVERITY_WEBAPP, origine
| where SEVERITY_WEBAPP="ERROR" OR SEVERITY_WEBAPP="FATAL" OR SEVERITY_WEBAPP="WARN" | rename SEVERITY_WEBAPP as SEVERITY | rename COMPONENTS_WEB as COMPONENTS]
[search source="/home/splunk/app4_error_core.log" | rex field=source "/././(?.)(?.)_(?.).log" | top limit=1 COMPONENTS_CORE by SEVERITY_CORE , origine
| where SEVERITY_CORE="ERROR" OR SEVERITY_CORE="FATAL" OR SEVERITY_CORE="WARN" | rename SEVERITY_CORE as SEVERITY | rename COMPONENTS_CORE as COMPONENTS]

[royimad]

The Solution is then:

| set union [search sourcetype="log4j" | rex field=source "/././(?.)_(?.)(?.).log"
| stats count by SEVERITY_WEBAPP, origine
| where SEVERITY_WEBAPP="ERROR" OR SEVERITY_WEBAPP="FATAL" OR SEVERITY_WEBAPP="WARN" | rename SEVERITY_WEBAPP as SEVERITY]
[search source="/home/splunk/app4_error_core.log" | rex field=source "/././(?.)(?.)_(?.).log" | stats count by SEVERITY_CORE , origine
| where SEVERITY_CORE="ERROR" OR SEVERITY_CORE="FATAL" OR SEVERITY_CORE="WARN" | rename SEVERITY_CORE as SEVERITY ]

| JOIN left outer origine,SEVERITY

[ set union [search sourcetype="log4j" | rex field=source "/././(?.)_(?.)(?.).log"
| top limit=1 COMPONENTS_WEB by SEVERITY_WEBAPP, origine
| where SEVERITY_WEBAPP="ERROR" OR SEVERITY_WEBAPP="FATAL" OR SEVERITY_WEBAPP="WARN" | rename SEVERITY_WEBAPP as SEVERITY | rename COMPONENTS_WEB as "TOP COMPONENTS"]
[search source="/home/splunk/app4_error_core.log" | rex field=source "/././(?.)(?.)_(?.).log" | top limit=1 COMPONENTS_CORE by SEVERITY_CORE , origine
| where SEVERITY_CORE="ERROR" OR SEVERITY_CORE="FATAL" OR SEVERITY_CORE="WARN" | rename SEVERITY_CORE as SEVERITY | rename COMPONENTS_CORE as "TOP COMPONENTS"] ]

[royimad]

Thanks dude!

[martin_mueller]

A more general thought, you may be able to pull the where SEVERITY_WEBAPP=somethingsomething part into the main searches, potentially improving performance. The earlier you can let splunk ignore events the less it needs to load off the disks and process.

[martin_mueller · Accepted solution]

Sure:

| set union [stats count | eval foo = 1] [stats count | eval foo = 1] | join count [set union [stats count | eval bar = 1] [stats count | eval bar = 1]]