Splunk Search

How to join searches based on condition?

AnujaJ
Path Finder

I have two searches :
Duration for which a device uses the system

index=device | fields device_start_time,device_end_time,device_id, duration, system_id
Time for which system is running

index=system | fields system_start_time,system_end_time, system_id, system_spec1,sstem_spec2,system_spec3
Now each device runs at different time, each system runs at different time. The multiple devices can subscribe to one running system at a time and assumes the specifications of the system. System have different specifications for different system_start and system_end times. So the results should contain co-related events for each device such that like device_start_time>=system_start_time AND device_end_time<=system_end_time AND system_id matches

Final result:
device_id,system_id,system_spec1,system_spec2,system_spec3

0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Hello @AnujaJ,

Try this query:

index=device | fields device_start_time,device_end_time,device_id, duration, system_id
| join system_id [| search index=system | fields system_start_time,system_end_time, system_id, system_spec1,sstem_spec2,system_spec3]
| where device_start_time>=system_start_time AND device_end_time<=system_end_time

Hope this helps!!! If this is not what you wanted describe question more here in the comment.

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

Hello @AnujaJ,

Try this query:

index=device | fields device_start_time,device_end_time,device_id, duration, system_id
| join system_id [| search index=system | fields system_start_time,system_end_time, system_id, system_spec1,sstem_spec2,system_spec3]
| where device_start_time>=system_start_time AND device_end_time<=system_end_time

Hope this helps!!! If this is not what you wanted describe question more here in the comment.

AnujaJ
Path Finder

Thank you that works perfectly! :slightly_smiling_face:

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...