Splunk Search

How to replace join command with any other alternative command for the below query?

pstalin_
Engager

index=105261-cli sourcetype=show_processes_cpu pid=0
| dedup deviceId
| fields deviceId, idle, fiveMinutes
| eval cpuLoad = round(if(isnull(fiveMinutes), 100-idle, fiveMinutes))
| join deviceId
[ search index=105261-np sourcetype=device_details
| fields deviceId, deviceName, productFamily, swVersion ]
| eval Status=if((cpuLoad <85 ), "OK" , "Not OK" )
| table deviceName, productFamily, cpuLoad, swVersion, Status
| sort - cpuLoad

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

@pstalin_ 

This query might do the trick. I believe your dedup will in practice get the most recent event from the cli index for that device, hence the use of latest(*)

(index=105261-cli sourcetype=show_processes_cpu pid=0) OR (index=105261-np sourcetype=device_details)
| fields deviceId, idle, fiveMinutes deviceId, deviceName, productFamily, swVersion
| stats latest(*) as * by deviceId
| eval cpuLoad = round(if(isnull(fiveMinutes), 100-idle, fiveMinutes))
| eval Status=if((cpuLoad <85 ), "OK" , "Not OK" )
| table deviceName, productFamily, cpuLoad, swVersion, Status
| sort - cpuLoad

but this

  • making the two combined searches
  • limiting fields to those needed from either search
  • using stats to 'join' the two data sets with latest(*) as * to handle all fields
  • then doing your post search calcs

Hope this helps.

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...