Splunk Search

Join only returns 1 value

arrowecssupport
Communicator

The search below looks up a serial number in another index, there will be multiple values to "x", but currently it only returns 1.
How do I get it to return all of the values?
Also, 2nd question, as it's only returning 1 value, how does it choose which value to return?

index = email
serialnumber=123456789
| join serialnumber type=left  [ search index=db  | dedup Y | rename serial AS serialnumber ]
| table serialnumber  X
Tags (1)
0 Karma

nickhills
Ultra Champion

Hi @arrowecssupport

I am making some assumptions about where the "single value" is coming from, but lets talk about dedup first.

dedup x means 'deduplicate x'
This has the effect of only returning unique values of x.

given values like:

serial x
----------
123  foo
456  bar
789  bar
012  baz

you would see one entry for each value of foo, bar, baz.

serial x
----------
123  foo
456  bar
012  baz

Your second question "how does it choose" - it will pick the most recent (last) entry in the set of results.

That does not always mean the latest (or last by time), which is why the sort order is important.
If you want it to be the latest by _time you should |sort - _time before you |dedup x

The last part of the puzzle is the join

join by default only matches 1 entry. It also chooses the 'last in the result set'
For the join to return more than one value, you need to specify how many.
|join max=<int> or use 0 to return all values.

If my comment helps, please give it a thumbs up!
0 Karma

arrowecssupport
Communicator

Ah shoot sorry, i've edited the post look again.

0 Karma

nickhills
Ultra Champion

Ok, thats thrown me a bit, but if I understand and my last edit on the join command follows the same logic as your question, try this:

index = email
 serialnumber=123456789
 | join serialnumber max=0 type=left  [ search index=db  | dedup Y | rename serial AS serialnumber ]
 | table serialnumber  X
If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

FYI i just updated your question title - Its not a subsearch, its the join that is causing it. Hopefully my suggestion above works!

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...