Splunk Search
Highlighted

Joining to other events to aggregate a single stats table with accurate count

Builder

I have a search that will return 95% of what I need from a single search, however the last piece of data I need is not in those events. I can join on an id in the search results to get the info I need from the subsearch, but when I do that the stats count that works fine without the join, seems to only return a subset or distinct count of events when joined and reported on with data from the subsearch

In other words they search itself finds 951 results, but the table built totals only 48 events.

| searchA errorfield
| join type=left joinfield [searchB
| fields joinfield field1
| stats counterrorfield AS numOf by field1 voy_errDescription
| xyseries errorfield,field1,numOf

0 Karma
Highlighted

Re: Joining to other events to aggregate a single stats table with accurate count

Explorer

I do not see your closing "]"

0 Karma
Highlighted

Re: Joining to other events to aggregate a single stats table with accurate count

Motivator

as rmaccum says
you forgot to close the second subsearch with "]"
close it and rerun your search
let me know if it work

0 Karma
Highlighted

Re: Joining to other events to aggregate a single stats table with accurate count

Builder

Sorry, yes I was closing it but mistyped. The data seems correct, but it seems to only return a subset of the count
| searchA errorfield
| join type=left joinfield [searchB
| fields joinfield field1]
| stats counterrorfield AS numOf by field1 voy_errDescription
| xyseries errorfield,field1,numOf

0 Karma