Splunk Search

How to do postprocessing without a join?

Mohsin123
Path Finder

index=abc caller-id IN ("8179f4c86", "926bbcf8957a") component=Chatbot

| join transaction id 
    [ search index=pqr component=$MSComp$
    logpoint=response-out (status="ok" OR status="error" OR status="failure" OR status="timeout")] 
| timechart span=$span$ count(eval(status="ok")) as Success count(eval(status="error")) as Error ,count(status) as total 
| eval Success=round((Success/total)*100,2) 
| eval Error=round((Error/total)*100,2) 
| eval failure=100-(Success+Error) 
| fields _time, failure ,Error,Success

I have lots of panels where this join is made.
Please help me with postprocessing without a join.

condition is : transaction -ids for the caller-ids in abc index is ame as  transaction-ids in index pqr
Tags (2)
0 Karma
1 Solution

gcusello
Legend

Hi shraddhamuduli
sometimes you can replace join or transaction with stats command, try something like this:

(index=abc (caller-id="8179f4c86" OR caller-id="926bbcf8957a") component=Chatbot)
OR (index=pqr component=$MSComp$ logpoint=response-out (status="ok" OR status="error" OR status="failure" OR status="timeout"))
| bin _time span=$span$
| stats values(status) AS status BYtransaction-id _time
| timechart  count(eval(status="ok")) as Success count(eval(status="error")) as Error count(status) as total 
| eval Success=round((Success/total)*100,2) 
| eval Error=round((Error/total)*100,2) 
| eval failure=100-(Success+Error) 
| fields _time failure Error Success

Bye.
Giuseppe

View solution in original post

0 Karma

woodcock
Esteemed Legend

Are you saying that the first search is your base search and the rest of your stuff below is your post-process search and furthermore that you have many panels with similar post-process searches which all start with the same |join []? If so, why not move the join to the base search?

0 Karma

gcusello
Legend

Hi shraddhamuduli
sometimes you can replace join or transaction with stats command, try something like this:

(index=abc (caller-id="8179f4c86" OR caller-id="926bbcf8957a") component=Chatbot)
OR (index=pqr component=$MSComp$ logpoint=response-out (status="ok" OR status="error" OR status="failure" OR status="timeout"))
| bin _time span=$span$
| stats values(status) AS status BYtransaction-id _time
| timechart  count(eval(status="ok")) as Success count(eval(status="error")) as Error count(status) as total 
| eval Success=round((Success/total)*100,2) 
| eval Error=round((Error/total)*100,2) 
| eval failure=100-(Success+Error) 
| fields _time failure Error Success

Bye.
Giuseppe

0 Karma

Mohsin123
Path Finder

Thanks
Just one concern :

The OR will give results belonging to caller-id in index=abc + the results belonging to index=pqr

here pqr might contain data belonging to other caller-ids as well

The flow is like

the data belonging to caller-ids in first index and the data belonging to same caller-id belonging to 2nd index is same on the basis of transaction id

the caller-id value changes when the data flows from index abc to index pqr

note, pqr is the 2nd layer(or entry point) to index layer abc

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...