Splunk Search

How to join two log files with matching strings?

RichaSingh
Path Finder

Hi ,
I have a log file with series of DFS path. Another csv file with an array of strings (which I refer to as Qtree). I would like to do a string search for each value of the field Qtree. This is what I have tried:

index=qt | eval search_id=Qtree | join search_id type=inner [search source=C:\Users\risingh\Desktop\qtree\dfsback.txt $search_id$ | fields _raw ]

This shows no results found.
Can someone please help me with this string array search and joining the two results? I have been trying for a really long to make a way out, but couldn't .... need to get this sorted!

Tags (3)
0 Karma

MuS
SplunkTrust
SplunkTrust

take a look at this: http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi... to get an idea how to get this done a different way .... because join should be a last resort .... not the first option to use

0 Karma

tachifelix
Path Finder

Try this
index=qt source=csvfile.csv |rename Qtree as search_id |join search_id type=inner [search source=C:\Users\risingh\Desktop\qtree\dfsback.txt $search_id$ | fields _raw ] ” or”index=qt source=csvfile.csv |join Qtree type=inner [search source=C:\Users\risingh\Desktop\qtree\dfsback.txt $ Qtree $ | fields _raw ]

0 Karma

vasanthmss
Motivator

Try this,

search source=C:\Users\risingh\Desktop\qtree\dfsback.txt | [index=qt  | stats count by Qtree | table Qtree | rename Qtree as search | format ]

Sub search will gives you the list of Qtree's from 'qt'.
Overall search will gives you the _raw data from the sourcefile which are matching Qtree from qt index.

V
0 Karma

RichaSingh
Path Finder

Appreciate the response!
But I have already tired those.
Any other work around if anyone could direct me to ?

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...