Splunk Search

How to add fields from subsearch ? Used Join but didnt work ...

kshanky143
Path Finder

I have a subsearch which returns a table with 2 columns 'input' and 'Time'. Table from subsearch looks like this.
input ---------------- Time
Movie1 ---------------- 2
Movie2 ---------------- 2
Movie3 ---------------- 2

Now i would like to return input and Time fields to my main search. As shown below, i'm using join to return input and Time, but it doesn't show any results. I would like to know if im doing anything wrong here ? or is there any better approach to get this done.

index=cas OR index=vod (sourcetype=ch AND input=) OR (sourcetype=ac AND id= AND code=) OR (sourcetype=hy AND ruid=)| join ,input, TimeInHours [search sourcetype=ch input=* | chart latest(Status) as stat earliest(_time) as earliest by input| eval Time=round(((now()-earliest)/60)/60) | where match(stat, "Failed") | table input,Time]

Thanks
Sheshank

Tags (3)
0 Karma

vasanthmss
Motivator

Hi,

What's the common field? I can see that common field TimeInHours is not available in the table result.

index=cas OR index=vod (sourcetype=ch AND input=) OR (sourcetype=ac AND id= AND code=) OR (sourcetype=hy AND ruid=)| join ,input, TimeInHours [search sourcetype=ch input=* | chart latest(Status) as stat earliest(_time) as earliest by input| eval Time=round(((now()-earliest)/60)/60) | where match(stat, "Failed") | table input,Time]

Assuming input is the only common field in both the searches,

index=cas OR index=vod (sourcetype=ch AND input=) OR (sourcetype=ac AND id= AND code=) OR (sourcetype=hy AND ruid=)| join input, TimeInHours [search sourcetype=ch input=* | chart latest(Status) as stat earliest(_time) as earliest by input| eval Time=round(((now()-earliest)/60)/60) | where match(stat, "Failed") | table input,Time]

execute the searches and check it manually input has common values,

Search 1: 
     index=cas OR index=vod (sourcetype=ch AND input=) OR (sourcetype=ac AND id= AND code=) OR (sourcetype=hy AND ruid=) | table input

Search 2:
sourcetype=ch input=* | chart latest(Status) as stat earliest(_time) as earliest by input| eval Time=round(((now()-earliest)/60)/60) | where match(stat, "Failed") | table input,Time
V
0 Karma

kshanky143
Path Finder

Hi

I dont have Time field at all to join. Thats what i have just realized now. Your answer makes more sense now.
Thanks.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...