Splunk Search

Can you help me with a subsearch?

jip31
Motivator

Hi,

I use the search below in order to display the model of a host for only the host which has a Wear_Rate>0

But the Model field is empty.

Could you help me to display the model for all the machines which have a Wear_Rate>0 please??

eventtype=Charge AND (NOT host=E* AND NOT host=I*) 
| stats first(FullChargedCapacity) AS FullChargedCapacity first(DesignedCapacity) AS DesignedCapacity first(_time) AS _time BY host 
| eval time = strftime(_time, "%m/%d/%Y %H:%M") 
| eval Wear_Rate = 100-(FullChargedCapacity *100/DesignedCapacity) 
| where Wear_Rate >0
| dedup host
| join type="outer" 
    [ search index="x" sourcetype="x" 
    | rex "Model=(?<model>.*)" 
    | stats values(model) as Model by host 
  ]
0 Karma
1 Solution

cvssravan
Path Finder

One basic observation is, you missed to mention the field on which you want to join, see below:

| join type="outer" host

try this and let me know if it worked

View solution in original post

0 Karma

cvssravan
Path Finder

One basic observation is, you missed to mention the field on which you want to join, see below:

| join type="outer" host

try this and let me know if it worked

0 Karma

jip31
Motivator

yes thanks

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...