Splunk Search

Error in 'join' command: Usage: join ()? [subsearch]

jeffreygaraygay
Explorer

I get the error "Error in 'join' command: Usage: join <options> (<join-fields>)? [subsearch]" when running the following search within a macro but it runs fine and produces desired results if i run it in a regular search without encasulating it inside a macro so it means that the main and subsearches inside the join command are working fine. Any help will be appreciated.

| inputlookup bank_statement | join type=outer key [search index=treasury sourcetype="treasury_wss_ebs" | regex path="ARCHIVE|ERROR" | regex path!="SWIFT" | eval mtime=round(strptime(modtime, "%a %b %d %H:%M:%S %Y")) | eval tz=strftime(now(),"%z") | eval offset=tonumber(tz/100) | eval eastern_time=mtime+(offset*60*60) | eval time=strftime(eastern_time, "%b %d %H:%M:%S %Y") | eval x=split(path,"/") | eval c=mvcount(x)-1 | eval filename=mvindex(x,c) | rex field=filename "^(?<bank>[^_]+)" | where bank!=filename | eval y=split(filename,"_") | eval type=mvindex(y,2) | eval x=mvindex(y,3) | rex field=x "^(?<location>[^\d]+)" | eval location=if(isnull(location),"-",location) | eval key=bank.type.location]

Tags (2)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Make sure the ENTIRE search is on a single line within the macros.conf file. Line breaks will kill this quite quickly.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...