Splunk Search

How do I split the output of the join in Splunk

arungeorge09
Path Finder

I have a splunk join between a synchornous event and an asynchornous event. The only join condition between these are just a correlation id. I am able to get the join but I want to now know what are the actual reason which caused it and would like to see the part of a join . How do I do that.

index=xyz platform=apns batch=496 event="NEAT-IN"  | join type=outer alertId [ search index=xyz event=cloudPns*  ] | stats count by responseCode

Now if the responseCode is 8 then I have a problem but I want to see all the events with event=cloudPns* alone for this join condition .

I tried where but it gave me 0 results.
what I tried is this:

index=qa-speed platform=apns batch=496 event="NEAT-IN"  | join type=outer alertId [ search index=qa-speed event=cloudPns*  ] |search where event=cloudPns*

How do I achieve this . I basically want to see the output of the right part of the join.

Tags (2)
0 Karma

lquinn
Contributor

Using the join command will literally join events together so you cannot then search only for part of an event. If you wanted to return the raw event from the righthand join you could maybe rename the _raw field before the join and then table it like this:

 index=qa-speed platform=apns batch=496 event="NEAT-IN"  | join type=outer alertId [ search index=qa-speed event=cloudPns* | rename _raw AS rawEvent ] | table rawEvent
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...