Splunk Search
Highlighted

Is it possible to have a joined search with condition A in the first search OR condition B in the second search?

New Member

Is it possible to have a joined search with condition A in the first search OR condition B in the second search?

0 Karma
Highlighted

Re: Is it possible to have a joined search with condition A in the first search OR condition B in the second search?

New Member

second search is a subsearch

0 Karma
Highlighted

Re: Is it possible to have a joined search with condition A in the first search OR condition B in the second search?

Builder

Almost certainly - can you give us a sample query you're working with? Hard to give the best answer otherwise

0 Karma
Highlighted

Re: Is it possible to have a joined search with condition A in the first search OR condition B in the second search?

New Member

index="exostar" sourcetype="ExostarFile" Comments=Comm
| JOIN type=left UserEmail [search index=ifed source=ExostarAudit
IFED "Comm WBS"=true ]

I want all events where Comments=Comm OR "Comm WBS"=true ]

0 Karma
Highlighted

Re: Is it possible to have a joined search with condition A in the first search OR condition B in the second search?

Ultra Champion

Retrieve events from the index

index=exostar (sourcetype=Exostar_File Comments=Comm ) OR (source=ExostarAudit_IFED "Comm WBS"=true)

I don't understand the intention of join , how about this?
Events that match either of the two conditions are searched.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.