All Apps and Add-ons

Fields lost from sub search

DerekKing
Path Finder

Hi,

I wonder if anyone can help with this please.

I have a search (that runs as part of the PCI compliance app) that when ran as two separate searches work fine, but joined together, the fields time & uptime are in the resultant table but empty. (within the inner search those fields are there and populated just fine).

This is the overall search (That nulls fields uptime and time) - Although asset_id is reported just fine.

| assets | join type=outer asset_id [| tstats summariesonly count,latest(All_Performance.OS.Uptime.uptime) as uptime,max(_time) as time from datamodel=Performance.All_Performance where nodename=All_Performance.OS.Uptime by All_Performance.dest | drop_dm_object_name(All_Performance) | get_asset(dest) | rename dest_asset_id as asset_id | unprepend_assets(dest) | search (get_category(pci)) () | fields time uptime asset_id]

If I simply run the inner search (This works perfectly - reporting time, uptime and asset_id)

| tstats summariesonly count,latest(All_Performance.OS.Uptime.uptime) as uptime,max(_time) as time from datamodel=Performance.All_Performance where nodename=All_Performance.OS.Uptime by All_Performance.dest | drop_dm_object_name(All_Performance) | get_asset(dest) | rename dest_asset_id as asset_id | unprepend_assets(dest) | search (get_category(pci)) () | fields time uptime asset_id

Any thoughts - appreciated.

Thanks
Derek

0 Karma
1 Solution

woodcock
Esteemed Legend

You need an outer join or a comparison that only keeps the members of each set that are not common to both sets. First of all, avoid using join whenever possible. Try this:

| assets | eval DATASET="assets" | appendpipe [| tstats summariesonly count,latest(All_Performance.OS.Uptime.uptime) as uptime,max(_time) as time from datamodel=Performance.All_Performance where nodename=All_Performance.OS.Uptime by All_Performance.dest | drop_dm_object_name(All_Performance) | get_asset(dest) | rename dest_asset_id as asset_id | unprepend_assets(dest) | search (`get_category(pci)`) () | fields time uptime asset_id | eval DATASET="tstats" ]
| stats dc(DATASET) as countDATASET values(*) AS * by asset_id
| search countDATASET=1

View solution in original post

0 Karma

woodcock
Esteemed Legend

You need an outer join or a comparison that only keeps the members of each set that are not common to both sets. First of all, avoid using join whenever possible. Try this:

| assets | eval DATASET="assets" | appendpipe [| tstats summariesonly count,latest(All_Performance.OS.Uptime.uptime) as uptime,max(_time) as time from datamodel=Performance.All_Performance where nodename=All_Performance.OS.Uptime by All_Performance.dest | drop_dm_object_name(All_Performance) | get_asset(dest) | rename dest_asset_id as asset_id | unprepend_assets(dest) | search (`get_category(pci)`) () | fields time uptime asset_id | eval DATASET="tstats" ]
| stats dc(DATASET) as countDATASET values(*) AS * by asset_id
| search countDATASET=1
0 Karma

DerekKing
Path Finder

Thanks woodcock, something you said made me realise that the assets were not marked in the asset lookup. I agree on the usage of join. Your approach is also a valid one.

Appreciate the help.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...