Splunk Search

Joining to other events to aggregate a single stats table with accurate count

Cuyose
Builder

I have a search that will return 95% of what I need from a single search, however the last piece of data I need is not in those events. I can join on an id in the search results to get the info I need from the subsearch, but when I do that the stats count that works fine without the join, seems to only return a subset or distinct count of events when joined and reported on with data from the subsearch

In other words they search itself finds 951 results, but the table built totals only 48 events.

| searchA errorfield
| join type=left joinfield [searchB
| fields joinfield field1
| stats counterrorfield AS numOf by field1 voy_errDescription
| xyseries errorfield,field1,numOf

0 Karma

rmarcum
Explorer

I do not see your closing "]"

0 Karma

chimell
Motivator

as rmaccum says
you forgot to close the second subsearch with "]"
close it and rerun your search
let me know if it work

0 Karma

Cuyose
Builder

Sorry, yes I was closing it but mistyped. The data seems correct, but it seems to only return a subset of the count
| searchA errorfield
| join type=left joinfield [searchB
| fields joinfield field1]
| stats counterrorfield AS numOf by field1 voy_errDescription
| xyseries errorfield,field1,numOf

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...