Splunk Search

Joining to other events to aggregate a single stats table with accurate count

Cuyose
Builder

I have a search that will return 95% of what I need from a single search, however the last piece of data I need is not in those events. I can join on an id in the search results to get the info I need from the subsearch, but when I do that the stats count that works fine without the join, seems to only return a subset or distinct count of events when joined and reported on with data from the subsearch

In other words they search itself finds 951 results, but the table built totals only 48 events.

| searchA errorfield
| join type=left joinfield [searchB
| fields joinfield field1
| stats counterrorfield AS numOf by field1 voy_errDescription
| xyseries errorfield,field1,numOf

0 Karma

rmarcum
Explorer

I do not see your closing "]"

0 Karma

chimell
Motivator

as rmaccum says
you forgot to close the second subsearch with "]"
close it and rerun your search
let me know if it work

0 Karma

Cuyose
Builder

Sorry, yes I was closing it but mistyped. The data seems correct, but it seems to only return a subset of the count
| searchA errorfield
| join type=left joinfield [searchB
| fields joinfield field1]
| stats counterrorfield AS numOf by field1 voy_errDescription
| xyseries errorfield,field1,numOf

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...