Splunk Search

Join command not working

user2020dy
Path Finder

I want to extend the results of the first search : add the column category  (from the 2 search) to the results of the 1 search.

The results of the first search appear:

user2020dy_0-1602171116551.png

The results of the 2 search are also present:

user2020dy_1-1602171168287.png

 2 datasets have one common field dns_query  .

But using join command no matches are found in these 2 datasets are found (it`s impossible, because I checked some of the dns_query )

 
 

image.png

 
 

Any ideas what can be wrong?

Labels (3)
0 Karma

to4kawa
Ultra Champion

1st search result dns_query:
  XXX.google.com

2nd search result dns_query:
  XXX.google.com.

There is extra asterisk on 2nd search.

[search `umbrella`|fields category dns_query| eval dns_query=dns_query."."]

how about this?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

While google.com exists in the dns_query fields, there isn't a complete match hence no results. You should evaluate the presence of google.com into another field in both searches and join on that field.

| rex field=dns_query "(?<google>google.com)"
0 Karma

ashajambagi
Communicator

Hi  @user2020dy 

You need to specify dns_query in the second search 

[search `umbrella`|fields category dns_query]
0 Karma

user2020dy
Path Finder

Have tried already both variants, not working 😞

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...