Splunk Search

How do I join searches or use nested searches?

kamaleshwar
Explorer

I would like to know how to join searches or how to use nested searches? Please help on this.

Tags (3)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

The documentation for join has a nice write up on the command that should get you started. In general for these types of questions I start with the Splunk Documentation. The docs teams does a good job.

One cautionary note: I would carefully consider if you need a join or not: there are a lot of other commands that can solve the problem where one would normally think they needed a join. Also, many of us with a SQL background seem to jump to join more quickly than they should because the terminology is familiar. There's nothing wrong with join; it's just that it's about the slowest and most "expensive" way to do what it does. So, if there's no way around using join then by all means USE it, but it can be worth it to ask in another question "I have this search with this join and it runs slow. Can someone help me rewrite it more efficiently?" (Obviously, a small set of sample data and a good description of what you are trying to accomplish is important there, too).

Anyway, good luck!

View solution in original post

Richfez
SplunkTrust
SplunkTrust

The documentation for join has a nice write up on the command that should get you started. In general for these types of questions I start with the Splunk Documentation. The docs teams does a good job.

One cautionary note: I would carefully consider if you need a join or not: there are a lot of other commands that can solve the problem where one would normally think they needed a join. Also, many of us with a SQL background seem to jump to join more quickly than they should because the terminology is familiar. There's nothing wrong with join; it's just that it's about the slowest and most "expensive" way to do what it does. So, if there's no way around using join then by all means USE it, but it can be worth it to ask in another question "I have this search with this join and it runs slow. Can someone help me rewrite it more efficiently?" (Obviously, a small set of sample data and a good description of what you are trying to accomplish is important there, too).

Anyway, good luck!

kamaleshwar
Explorer

yeah, thanks! i've found some other way to make the query efficiently run.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...