Splunk Search

How to join data on my two sources (A and B) on the fields?

boxmetal
Path Finder

Hi, I need to join data on my 2 source A and B on the fields "Workitems_URL" and "Work Item URL" 

In source B, there is field "Type Name" that all of its join match must have this field contain value "Default" for a valid match.

If any of the matches do not have "Type Name" as "Default" then it will not be counted.

I tried to use a filter "Type Name"="Default" for the source B but it does not seem to be correct.

Please let me know how to make this work

Thanks

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try like this

index="tdg1" host="005540" source="C:\\ALM\\CCM\\WorkItem\\Workitems.csv"
| join left=L right=R where L.Workitems_URL=R."Work Item URL"
[ search index="tdg1" source="C:\\ALM\\JRS\\TestCase_Test_WorkItem.csv"
| where 'Type Name'="Default"
]
| stats count

Note the single quotes around the field name in the where command

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Please can you share the SPL that you have tried

0 Karma

boxmetal
Path Finder

Sure. It's like this

index="tdg1" host="005540" source="C:\\ALM\\CCM\\WorkItem\\Workitems.csv"
| join left=L right=R where L.Workitems_URL=R."Work Item URL"
[ search index="tdg1" source="C:\\ALM\\JRS\\TestCase_Test_WorkItem.csv" "Type Name"="Default"
]
| stats count

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try like this

index="tdg1" host="005540" source="C:\\ALM\\CCM\\WorkItem\\Workitems.csv"
| join left=L right=R where L.Workitems_URL=R."Work Item URL"
[ search index="tdg1" source="C:\\ALM\\JRS\\TestCase_Test_WorkItem.csv"
| where 'Type Name'="Default"
]
| stats count

Note the single quotes around the field name in the where command

Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...