Splunk Search

Join 2 search - Want to display both common and non-common values

jayannah
Builder

index=abc earliest=-7d@d latest=-6d@d action=commit_success | stats count as SUCCESS by user

Gives the result:
user SUCCESS
user1 2
user4 10
user20 7
user50 12
user55 4
user60 10

Commit failed for users:
index=abc earliest=-7d@d latest=-6d@d action=commit_failed | stats count as FAIL by user

Gives the result:
user FAIL
user1 3
user5 2
user20 4
user40 1
user50 4
user70 2

Please note, here some users have made successful commit only, some did both success & fail and some did commit fail only.

I want to combine these 2 results.

combine with append:
user SUCCESS FAIL
user1 2
user4 10
user20 7
user50 12
user55 4
user60 10
user1 3
user5 2
user20 4
user40 1
user50 4
user70 2

Here the problem is the user names appears 2 times in row for user who have done both success and fail commits


If combine with appendcols:
user SUCCESS FAIL
user1 2 3
user4 10 2
user20 7 4
user50 12 1
user55 4 4
user60 10 2

Here the problem is totally incorrect FAIL count for improper users.


if I combine with "join"
It either gives me the common name (by default),
if I use type=inner, the failure committed users only are ignored
if I use type=outer, the success committed user only ignore.

But, I want to all the users who have committed success and failures to be display and only 1 row per user even if the user has done both failure and success.

I want the result to be like this
user SUCCESS FAIL
user1 2 3
user4 10
user5 2
user20 7 4
user40 1
user50 12 4
user55 4
user60 10
user70 2

Please do the needful.

Tags (1)
0 Karma
1 Solution

HiroshiSatoh
Champion

It is not possible to "FULL OUTER JOIN" in JOIN
How about collecting this result by STATS further?

combine with append:
user SUCCESS FAIL
user1 2
user4 10
user20 7
user50 12
user55 4
user60 10
user1 3
user5 2
user20 4
user40 1
user50 4
user70 2

・・・|stats max(SUCCESS) as SUCCESS,max(FAIL) as FAIL by user
user SUCCESS FAIL
user1 2 3
user4 10
user5 2
user20 7 4
user40 1
user50 12 4
user55 4
user60 10
user70 2

View solution in original post

HiroshiSatoh
Champion

It is not possible to "FULL OUTER JOIN" in JOIN
How about collecting this result by STATS further?

combine with append:
user SUCCESS FAIL
user1 2
user4 10
user20 7
user50 12
user55 4
user60 10
user1 3
user5 2
user20 4
user40 1
user50 4
user70 2

・・・|stats max(SUCCESS) as SUCCESS,max(FAIL) as FAIL by user
user SUCCESS FAIL
user1 2 3
user4 10
user5 2
user20 7 4
user40 1
user50 12 4
user55 4
user60 10
user70 2

Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...