Splunk Search

Join with condition OR

gibba
Path Finder

Hi Everyone

i need to use a splunk join,

i want ask is possible use two field with OR condition

Example

my search | fields column 1, column 2, column 3 | join cloumn 1 OR column 2 [ my second search]

thank you
For your time

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Skip join entirely (it has inescapable limits) and do this

my saearch OR my second search | eval joiner=coalesce(column1, column2) | stats values(*) AS* BY joiner | fields - joiner

Just try it before you think it won't work.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Skip join entirely (it has inescapable limits) and do this

my saearch OR my second search | eval joiner=coalesce(column1, column2) | stats values(*) AS* BY joiner | fields - joiner

Just try it before you think it won't work.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi gibba,
no you cannot use an OR condition in a join.
What's the problem values in column1 and column2?
if this is the problem you could use an eval with coalesce function

my search 
| eval column=coalesce(column1,column2) 
| join column [ my second search]

Bye.
Giuseppe

0 Karma

gibba
Path Finder

Ciao Giuseppe

i try to use olny one column beacause the second sometimes is null but i can't use coalesce beacuase i need column 2= null

thank for your time

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...