Splunk Search

How to join data on my two sources (A and B) on the fields?

boxmetal
Path Finder

Hi, I need to join data on my 2 source A and B on the fields "Workitems_URL" and "Work Item URL" 

In source B, there is field "Type Name" that all of its join match must have this field contain value "Default" for a valid match.

If any of the matches do not have "Type Name" as "Default" then it will not be counted.

I tried to use a filter "Type Name"="Default" for the source B but it does not seem to be correct.

Please let me know how to make this work

Thanks

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try like this

index="tdg1" host="005540" source="C:\\ALM\\CCM\\WorkItem\\Workitems.csv"
| join left=L right=R where L.Workitems_URL=R."Work Item URL"
[ search index="tdg1" source="C:\\ALM\\JRS\\TestCase_Test_WorkItem.csv"
| where 'Type Name'="Default"
]
| stats count

Note the single quotes around the field name in the where command

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Please can you share the SPL that you have tried

0 Karma

boxmetal
Path Finder

Sure. It's like this

index="tdg1" host="005540" source="C:\\ALM\\CCM\\WorkItem\\Workitems.csv"
| join left=L right=R where L.Workitems_URL=R."Work Item URL"
[ search index="tdg1" source="C:\\ALM\\JRS\\TestCase_Test_WorkItem.csv" "Type Name"="Default"
]
| stats count

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try like this

index="tdg1" host="005540" source="C:\\ALM\\CCM\\WorkItem\\Workitems.csv"
| join left=L right=R where L.Workitems_URL=R."Work Item URL"
[ search index="tdg1" source="C:\\ALM\\JRS\\TestCase_Test_WorkItem.csv"
| where 'Type Name'="Default"
]
| stats count

Note the single quotes around the field name in the where command

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...