Splunk Search

How to join two log files with matching strings?

Path Finder

Hi ,
I have a log file with series of DFS path. Another csv file with an array of strings (which I refer to as Qtree). I would like to do a string search for each value of the field Qtree. This is what I have tried:

index=qt | eval search_id=Qtree | join search_id type=inner [search source=C:\Users\risingh\Desktop\qtree\dfsback.txt $search_id$ | fields _raw ]

This shows no results found.
Can someone please help me with this string array search and joining the two results? I have been trying for a really long to make a way out, but couldn't .... need to get this sorted!

Tags (3)
0 Karma


take a look at this: http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi... to get an idea how to get this done a different way .... because join should be a last resort .... not the first option to use

0 Karma

Path Finder

Try this
index=qt source=csvfile.csv |rename Qtree as search_id |join search_id type=inner [search source=C:\Users\risingh\Desktop\qtree\dfsback.txt $search_id$ | fields _raw ] ” or”index=qt source=csvfile.csv |join Qtree type=inner [search source=C:\Users\risingh\Desktop\qtree\dfsback.txt $ Qtree $ | fields _raw ]

0 Karma


Try this,

search source=C:\Users\risingh\Desktop\qtree\dfsback.txt | [index=qt  | stats count by Qtree | table Qtree | rename Qtree as search | format ]

Sub search will gives you the list of Qtree's from 'qt'.
Overall search will gives you the _raw data from the sourcefile which are matching Qtree from qt index.

0 Karma

Path Finder

Appreciate the response!
But I have already tired those.
Any other work around if anyone could direct me to ?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...