Splunk Search

Join with condition OR

gibba
Path Finder

Hi Everyone

i need to use a splunk join,

i want ask is possible use two field with OR condition

Example

my search | fields column 1, column 2, column 3 | join cloumn 1 OR column 2 [ my second search]

thank you
For your time

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Skip join entirely (it has inescapable limits) and do this

my saearch OR my second search | eval joiner=coalesce(column1, column2) | stats values(*) AS* BY joiner | fields - joiner

Just try it before you think it won't work.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Skip join entirely (it has inescapable limits) and do this

my saearch OR my second search | eval joiner=coalesce(column1, column2) | stats values(*) AS* BY joiner | fields - joiner

Just try it before you think it won't work.

View solution in original post

0 Karma

gcusello
Legend

Hi gibba,
no you cannot use an OR condition in a join.
What's the problem values in column1 and column2?
if this is the problem you could use an eval with coalesce function

my search 
| eval column=coalesce(column1,column2) 
| join column [ my second search]

Bye.
Giuseppe

0 Karma

gibba
Path Finder

Ciao Giuseppe

i try to use olny one column beacause the second sometimes is null but i can't use coalesce beacuase i need column 2= null

thank for your time

0 Karma