Splunk Search

How to display all data sets for each time bucket combined with join, append or appendcols when data for one data set is missing?

DanielFordWA
Contributor

I would like to see the following

_time Data1 Data2
2014-10-01 22 1
2014-10-02 32 8
2014-10-03 46 -
2014-10-04 54 10

However when ever I'm using join / append / appendcols I only get the following. The time bucket with no data for one of the Data sets causes the entire bucket not display.

_time Data1 Data2
2014-10-01 22 1
2014-10-02 32 8
2014-10-04 54 10

I have tried fillnull and other methods but I can't get it to work. It seems quite a straight forward thing to do, I think I am missing something.

Hope you can Help!

1 Solution

musskopf
Builder

I suspect you're using join to combine Data1 and Data2 right? If that's the case, are you using the option type=left?

This option basically tells the join keep events even if there is no match on the subsearch. By default join uses type=inner, which means that only joined events will be kept.

View solution in original post

somesoni2
Revered Legend

What's the query you're executing?

0 Karma

musskopf
Builder

I suspect you're using join to combine Data1 and Data2 right? If that's the case, are you using the option type=left?

This option basically tells the join keep events even if there is no match on the subsearch. By default join uses type=inner, which means that only joined events will be kept.

DanielFordWA
Contributor

Thanks for this. I resolved the issues now.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...