Getting Data In

How does the JOIN or single TRANSACTION work in same log file having multiple source types when we don't have a unique key or referential key?

Aakanksha
Path Finder

Pleas Check Sample Data and Query

link text

Tags (1)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

JOIN and TRANSACTION both require at least one field to correlate events.

  • About the same log file : The JOIN uses a sub search so it could use the same results than the main search.
  • is the excel example the actual log file ?

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

JOIN and TRANSACTION both require at least one field to correlate events.

  • About the same log file : The JOIN uses a sub search so it could use the same results than the main search.
  • is the excel example the actual log file ?

View solution in original post

0 Karma

Aakanksha
Path Finder

For calculations, we used the below approach:

((A/((SUM(A,B,H)-SUM(D,C,G,E,F)))100))

In Splunk:

sourcetype=source1 | join date,time [search sourcetype=source3] | eval add1 = A +B+ H|join date,time [search sourcetype=source2] | eval add2=C+D |join date,time [search sourcetype=source3] |eval add3 =G+E|eval add4 = F+add3|eval sub = add1 - add4 |eval div = A/sub |eval final-result = div*100

By using “join” function here, we were able to get column names of all three source types and use eval on them. But the join does not consider all the possible combinations.
SHEET contains sample data.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!