Splunk Search

How to use join using stats by count on two different searches?

msrama5
Explorer

Hello, I am trying to use the join by userid on 2 different sub queries using join feature, both the queries are returning the data when individually ran, but is not returning the data when used with join, what is missing in query below to join by userid ?

earliest=-1h sourcetype=GATEWAY | stats count by UserId , cc.Type, Error.Code 
| table first_table | join UserId   [ | search earliest=-1h sourcetype=GATEWAY  ReasonCode="Authorized"| stats count by UserId , cc.Type|  table second_table]
Tags (3)
0 Karma

woodcock
Esteemed Legend

Start with this:

earliest=-1h sourcetype=GATEWAY
| stats count count(eval(ReasonCode="Authorized")) BY UserId , cc.Type, Error.Code
0 Karma

somesoni2
Revered Legend

Get rid of those | table first_table and | table second_table. The table command is to selectively show the fields from result of the search, so your current searches are trying to return fields 'first_table' and 'second_table' which do not exist and join fails.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...