All Apps and Add-ons

How to join or lookup results from one search to another for table output?

GeorgeStarkey
Path Finder

in the vmware app the following pieces exist

index=vmware-perf
moid mem_used mem_committed

index=vmware-inv
moid changeSet.name

changeset.name is the actual hostame of the vm's so endusers can easily identify.

I want to run something like this:
index=vmware-perf sourcetype=vmware:perf:mem moid=vm* | eval overuse=mem_committed-mem_used | stats min(overuse) by moid,mem_committed,mem_used | dedup moid

HOWEVER I then want to join (or lookup/remap) the changeSet.name from the other index based on the moid so that I can end up with a table that shows:

changeSet.name moid mem_committed mem_used overuse
host1 vm-5619 65222 32001.238281 33220.761719
host2 vm-822 65138 35497.636719 29640.363281
etc..

This is probably a simple join, but I can't quite get it to function

1 Solution

GeorgeStarkey
Path Finder

I have solved this myself with:

index=vmware-perf
sourcetype=vmware:perf:mem moid=vm*
mem_committed>1 | join moid [search
index=vmware-inv moid=*
changeSet.name=vm*] | eval
overuse=mem_committed-mem_used | stats
min(overuse) by
changeSet.name,moid,mem_committed,mem_used
| dedup moid

though this is still very slow. there must be a faster way.

View solution in original post

GeorgeStarkey
Path Finder

I have solved this myself with:

index=vmware-perf
sourcetype=vmware:perf:mem moid=vm*
mem_committed>1 | join moid [search
index=vmware-inv moid=*
changeSet.name=vm*] | eval
overuse=mem_committed-mem_used | stats
min(overuse) by
changeSet.name,moid,mem_committed,mem_used
| dedup moid

though this is still very slow. there must be a faster way.

mipeters_splunk
Splunk Employee
Splunk Employee

the faster way would be to use data models and use the |tstats command with summariesonly. Good luck !!!!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...