Splunk Search

How to join searches based on condition?

AnujaJ
Path Finder

I have two searches :
Duration for which a device uses the system

index=device | fields device_start_time,device_end_time,device_id, duration, system_id
Time for which system is running

index=system | fields system_start_time,system_end_time, system_id, system_spec1,sstem_spec2,system_spec3
Now each device runs at different time, each system runs at different time. The multiple devices can subscribe to one running system at a time and assumes the specifications of the system. System have different specifications for different system_start and system_end times. So the results should contain co-related events for each device such that like device_start_time>=system_start_time AND device_end_time<=system_end_time AND system_id matches

Final result:
device_id,system_id,system_spec1,system_spec2,system_spec3

0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Hello @AnujaJ,

Try this query:

index=device | fields device_start_time,device_end_time,device_id, duration, system_id
| join system_id [| search index=system | fields system_start_time,system_end_time, system_id, system_spec1,sstem_spec2,system_spec3]
| where device_start_time>=system_start_time AND device_end_time<=system_end_time

Hope this helps!!! If this is not what you wanted describe question more here in the comment.

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

Hello @AnujaJ,

Try this query:

index=device | fields device_start_time,device_end_time,device_id, duration, system_id
| join system_id [| search index=system | fields system_start_time,system_end_time, system_id, system_spec1,sstem_spec2,system_spec3]
| where device_start_time>=system_start_time AND device_end_time<=system_end_time

Hope this helps!!! If this is not what you wanted describe question more here in the comment.

AnujaJ
Path Finder

Thank you that works perfectly! 🙂

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...