Splunk Search

How to search by variable created within a join query?

akonduru
New Member

I want join/combine two searches by their common value to compare transaction success/failure rate at both places. i tried something below, but unable to search by evaluated result

Step1: Extract substring from second log as this value exactly doesn't match within first log.

index=indexoffirstlog sourcetype="secondlog" eval length=len(fieldinterestedin) | eval transaction_id=substr(fieldinterestedin, 6, length)

Step2: Search results within first log where result contain transaction_id (Not Joined yet, just checking first log query alone)

index=indexoffsfirstlog sourcetype="firstlog" matchstringoffirstlog

Step3: Now join both searches and search by transaction_id

index=indexoffirstlog AND index=indexofsecondlog sourcetype="secondlog" matchstringoffirstlog | eval length=len(fieldinterestedin) | eval result=substr(fieldinterestedin, 6, length) | search result

But i am not getting any results. appreciate any advice.

Tags (1)
0 Karma

woodcock
Esteemed Legend

Change your AND to OR!

0 Karma

somesoni2
Revered Legend

Is the length of fieldinterestedin constant?

0 Karma

akonduru
New Member

No, It is not same. length varies. But fieldinterestedin always start wit constant like "ABCD23423fsdfsd" where ABCD is constant.

0 Karma

somesoni2
Revered Legend

Final doubt, if you remove the constant part in the fieldinterestedin field from search 2, would it match exactly with fieldinterestedin in search 1?

0 Karma

akonduru
New Member

yes, it match except the constant part which is why i am doing substring to take off Constant part.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...