Splunk Search

Ignore results that do not appear in a separate search

Amohlmann
Communicator

A quick run down of what I want first:
I have a bunch of data flowing in for production, test, and training environments. I would like to filter out the test and training environments. Each environment has a unique ID which I would like to cross reference from a database using DBX. Then run stats on the remaining results

The two searches I want to combine:

 host=MASTER *error* Message=$ErrorSelection$|stats count by siteID|sort -num(count)

And

| dbquery "SQLDB" "SELECT * FROM SubscriptionTable WHERE IsProduction=1"

I would like to join both searches by their "siteID" then only display the sitesIDs that have IsProduction=1

0 Karma

stephane_cyrill
Builder

remove the pipe between search and dbquery
In the answer of NOUMSSI.

0 Karma

NOUMSSI
Builder

Hi try this:

host=MASTER *error* Message=$ErrorSelection$|stats count by siteID|sort -num(count) | join [search | dbquery "SQLDB" "SELECT * FROM SubscriptionTable WHERE IsProduction=1"]

NOUMSSI
Builder

ok try this:

host=MASTER *error* Message=$ErrorSelection$|stats count by siteID|sort -num(count) | join [search  dbquery "SQLDB" "SELECT * FROM SubscriptionTable WHERE IsProduction=1"]

I've just remove pipe

0 Karma

Amohlmann
Communicator

I get the following error:
Error in 'dbquery' command: This command must be the first command of a search.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...