Splunk Search

How do I join two data models in a TSTATS without using JOIN or APPENDCOLS

ymourtaza
New Member

Hello all,

I would like to pick the community's brains on this:

How do I join two data models in a TSTATS without using JOIN or APPENDCOLS?

Here are the actual searches that I have right now (one is using JOIN, one is using APPENDCOLS)

| tstats summariesonly=true latest(_time) as _time count AS "Count of Web" dc(Web.src) AS "Distinct Count of src" from datamodel=Web where (nodename = Web) groupby Web.src, Web.dest, Web.url, Web.http_user_agent, sourcetype, Web.user 
| rename Web.src as src_ip
| join type=outer src_ip 
    [| tstats count AS "Count of Allowed Traffic" dc(All_Traffic.src_ip) AS "Distinct Count of src_ip" from datamodel=Network_Traffic where (nodename = All_Traffic.Traffic_By_Action.Allowed_Traffic) (All_Traffic.dest_ip!="10.*") (All_Traffic.direction="out*") groupby All_Traffic.src_ip, All_Traffic.dest_ip, sourcetype, All_Traffic.action, _time]

| tstats summariesonly=true latest(_time) as _time count AS "Count of Web" dc(Web.src) AS "Distinct Count of src" from datamodel=Web where (nodename = Web) groupby Web.src, Web.dest, Web.url, Web.http_user_agent, sourcetype, Web.user
| rename Web.src as src_ip
| appendcols 
    [| tstats count AS "Count of Allowed Traffic" dc(All_Traffic.src_ip) AS "Distinct Count of src_ip" from datamodel=Network_Traffic where (nodename = All_Traffic.Traffic_By_Action.Allowed_Traffic) (All_Traffic.dest_ip!="10.*") (All_Traffic.direction="out*") groupby All_Traffic.src_ip, All_Traffic.dest_ip, sourcetype, All_Traffic.action, _time]
    | stats latest(_time) as _time index values(dest) as dest_ip values(web.url) as web.url count by src_ip

Thanks!

Tags (3)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!