Splunk Search

How to add fields from subsearch ? Used Join but didnt work ...

kshanky143
Path Finder

I have a subsearch which returns a table with 2 columns 'input' and 'Time'. Table from subsearch looks like this.
input ---------------- Time
Movie1 ---------------- 2
Movie2 ---------------- 2
Movie3 ---------------- 2

Now i would like to return input and Time fields to my main search. As shown below, i'm using join to return input and Time, but it doesn't show any results. I would like to know if im doing anything wrong here ? or is there any better approach to get this done.

index=cas OR index=vod (sourcetype=ch AND input=) OR (sourcetype=ac AND id= AND code=) OR (sourcetype=hy AND ruid=)| join ,input, TimeInHours [search sourcetype=ch input=* | chart latest(Status) as stat earliest(_time) as earliest by input| eval Time=round(((now()-earliest)/60)/60) | where match(stat, "Failed") | table input,Time]

Thanks
Sheshank

Tags (3)
0 Karma

vasanthmss
Motivator

Hi,

What's the common field? I can see that common field TimeInHours is not available in the table result.

index=cas OR index=vod (sourcetype=ch AND input=) OR (sourcetype=ac AND id= AND code=) OR (sourcetype=hy AND ruid=)| join ,input, TimeInHours [search sourcetype=ch input=* | chart latest(Status) as stat earliest(_time) as earliest by input| eval Time=round(((now()-earliest)/60)/60) | where match(stat, "Failed") | table input,Time]

Assuming input is the only common field in both the searches,

index=cas OR index=vod (sourcetype=ch AND input=) OR (sourcetype=ac AND id= AND code=) OR (sourcetype=hy AND ruid=)| join input, TimeInHours [search sourcetype=ch input=* | chart latest(Status) as stat earliest(_time) as earliest by input| eval Time=round(((now()-earliest)/60)/60) | where match(stat, "Failed") | table input,Time]

execute the searches and check it manually input has common values,

Search 1: 
     index=cas OR index=vod (sourcetype=ch AND input=) OR (sourcetype=ac AND id= AND code=) OR (sourcetype=hy AND ruid=) | table input

Search 2:
sourcetype=ch input=* | chart latest(Status) as stat earliest(_time) as earliest by input| eval Time=round(((now()-earliest)/60)/60) | where match(stat, "Failed") | table input,Time
V
0 Karma

kshanky143
Path Finder

Hi

I dont have Time field at all to join. Thats what i have just realized now. Your answer makes more sense now.
Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...