Splunk Search

Join - how do I fillnull on a join?

the_wolverine
Champion

Join is much more efficient. Is it possible to fillnull on a join so that I can collect the results for events for which there isn't an event to join?

sourcetype=1 | join host [ search sourcetype=2 | fields host,result ] | table host,result

sbsbb
Builder

you can also set the join type to left for example :

sourcetype=1 | join type=left host [ search sourcetype=2 | fields host,result ] | table host,result

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Join

then you will see every restults from sourcetype, and where there is no events from sourcetype2, the field will only be empty. If you want in place of empty, a 0, then you can add a fillnull...

sourcetype=1 | join type=left host [ search sourcetype=2 | fields host,result ] | fillnull value=0 | table host,result

http://docs.splunk.com/Special:SplunkSearch/docs?q=fillnull

jfcshunter
Explorer

Good answer thanks, link updated for newest version (July 2021): 

https://docs.splunk.com/Documentation/Splunk/8.2.1/SearchReference/Join

Tags (1)
0 Karma

dwaddle
SplunkTrust
SplunkTrust

If this is related to your transaction question (http://splunk-base.splunk.com/answers/59493/mostmore-efficient-way-of-counting-incomplete-transactio...) , you may be disappointed here. I think join will run into subsearch limits and not give you the results you desire when there are enough rows to be joined.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...