Splunk Search

Join command not working

user2020dy
Path Finder

I want to extend the results of the first search : add the column category  (from the 2 search) to the results of the 1 search.

The results of the first search appear:

user2020dy_0-1602171116551.png

The results of the 2 search are also present:

user2020dy_1-1602171168287.png

 2 datasets have one common field dns_query  .

But using join command no matches are found in these 2 datasets are found (it`s impossible, because I checked some of the dns_query )

 
 

image.png

 
 

Any ideas what can be wrong?

Labels (3)
0 Karma

to4kawa
Ultra Champion

1st search result dns_query:
  XXX.google.com

2nd search result dns_query:
  XXX.google.com.

There is extra asterisk on 2nd search.

[search `umbrella`|fields category dns_query| eval dns_query=dns_query."."]

how about this?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

While google.com exists in the dns_query fields, there isn't a complete match hence no results. You should evaluate the presence of google.com into another field in both searches and join on that field.

| rex field=dns_query "(?<google>google.com)"
0 Karma

ashajambagi
Communicator

Hi  @user2020dy 

You need to specify dns_query in the second search 

[search `umbrella`|fields category dns_query]
0 Karma

user2020dy
Path Finder

Have tried already both variants, not working 😞

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...