Splunk Search

Joining to other events to aggregate a single stats table with accurate count

Cuyose
Builder

I have a search that will return 95% of what I need from a single search, however the last piece of data I need is not in those events. I can join on an id in the search results to get the info I need from the subsearch, but when I do that the stats count that works fine without the join, seems to only return a subset or distinct count of events when joined and reported on with data from the subsearch

In other words they search itself finds 951 results, but the table built totals only 48 events.

| searchA errorfield
| join type=left joinfield [searchB
| fields joinfield field1
| stats counterrorfield AS numOf by field1 voy_errDescription
| xyseries errorfield,field1,numOf

0 Karma

rmarcum
Explorer

I do not see your closing "]"

0 Karma

chimell
Motivator

as rmaccum says
you forgot to close the second subsearch with "]"
close it and rerun your search
let me know if it work

0 Karma

Cuyose
Builder

Sorry, yes I was closing it but mistyped. The data seems correct, but it seems to only return a subset of the count
| searchA errorfield
| join type=left joinfield [searchB
| fields joinfield field1]
| stats counterrorfield AS numOf by field1 voy_errDescription
| xyseries errorfield,field1,numOf

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!