Splunk Search

Join result of two queries with common field ?

ayush8878
New Member

Hi,

I have a use case where i need to join result of two septate logs on the basis of common field(breadcrumbId).
Below is the query i used but i am not getting any results for this query

source="/opt/jboss/jboss-fuse/data/log/access_log" OR "/opt/jboss/jboss-fuse/data/log/fuse.log" ("Audience value in the JWT is*" OR ("path=/rest/cases/" "filename*=")) | stats values(*) as * by breadcrumbId | table breadcrumbId AccessedFrom

While if I try separately I am getting results

Query 1:source="/opt/jboss/jboss-fuse/data/log/fuse.log" "Audience value in the JWT is" | table breadcrumbId AccessedFrom 
Query 2:source="/opt/jboss/jboss-fuse/data/log/access_log" (("path=/rest/cases/" "filename*=")) | stats values(*) as * by breadcrumbId filename
0 Karma

woodcock
Esteemed Legend

It must be that the first source has no events with values for filename so leave it in the values(*) pile like this:

index="YouShouldAlwaysSpecifyAnIndex" AND
((source="/opt/jboss/jboss-fuse/data/log/fuse.log" AND "Audience value in the JWT is") OR
(source="/opt/jboss/jboss-fuse/data/log/access_log" AND "path=/rest/cases/" AND "filename*="))
| stats values(*) AS * BY breadcrumbId
0 Karma

MuS
Legend

Hi ayush8878,

try this:

( source="/opt/jboss/jboss-fuse/data/log/fuse.log" "Audience value in the JWT is" ) OR ( source="/opt/jboss/jboss-fuse/data/log/access_log" ("path=/rest/cases/" "filename*=")) 
| eval filename=if(isnotnull(filename), filename, "none") 
| stats values(*) AS * by breadcrumbid filename

Hope this helps ...

cheers, MuS

0 Karma

ayush8878
New Member

Thanks MuS but this way I am getting resuls only from fuse.log while I need data from access.log and fuse.log merged on breadcrumbid

0 Karma

MuS
Legend

Okay, looking at the second search on the access_log you use "filename*=" so you don't actually search for a field called filename. The first thing you need to do here is create a field called filename and then it will work. Assuming the filename* thingy does not contain any spaces, try this:

( source="/opt/jboss/jboss-fuse/data/log/fuse.log" "Audience value in the JWT is" ) OR ( source="/opt/jboss/jboss-fuse/data/log/access_log" ("path=/rest/cases/" "filename*=")) 
 | rex "filename[^=]*=(?<filename>[^\s]+)" 
 | eval filename=if(isnotnull(filename), filename, "none") 
 | stats values(*) AS * by breadcrumbid filename

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...