Splunk Search

Join with condition OR

gibba
Path Finder

Hi Everyone

i need to use a splunk join,

i want ask is possible use two field with OR condition

Example

my search | fields column 1, column 2, column 3 | join cloumn 1 OR column 2 [ my second search]

thank you
For your time

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Skip join entirely (it has inescapable limits) and do this

my saearch OR my second search | eval joiner=coalesce(column1, column2) | stats values(*) AS* BY joiner | fields - joiner

Just try it before you think it won't work.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Skip join entirely (it has inescapable limits) and do this

my saearch OR my second search | eval joiner=coalesce(column1, column2) | stats values(*) AS* BY joiner | fields - joiner

Just try it before you think it won't work.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi gibba,
no you cannot use an OR condition in a join.
What's the problem values in column1 and column2?
if this is the problem you could use an eval with coalesce function

my search 
| eval column=coalesce(column1,column2) 
| join column [ my second search]

Bye.
Giuseppe

0 Karma

gibba
Path Finder

Ciao Giuseppe

i try to use olny one column beacause the second sometimes is null but i can't use coalesce beacuase i need column 2= null

thank for your time

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...