Splunk Search

Removing redundancy from query

dhruv101
Path Finder

Hi,
I have a query with 5 joins but I am sure that this can be reduced to just one join. I cant figure out the syntax for doing so though. Need something like the following but I know this kind of syntax is not valid.

if(payload.type="Foo", stats count as foocnt by txnid)

Query -

            index="event" eventType="A"
            | eval diff = $$payload.endVal$$ - $$payload.beginVal$$
            | search diff=$someval$
            | eval txnid = $$payload.ID$$
            | join type=left txnid [search index="event" eventType="B" payload.type="Foo"
            | eval txnid = $$payload.ID$$
            | stats count as foocnt by txnid]
            | join type=left txnid [search index="app_event" eventType="B" payload.type="Bar"
            | eval txnid = $$payload.ID$$
            | stats count as barcnt by txnid]
            | join type=left txnid [search index="app_event" eventType="B" payload.type="Hello"
            | eval txnid = $$payload.ID$$
            | stats count as hlcnt by txnid] 
            | join type=left txnid [search index="app_event"eventType="B" payload.type="World"
            | eval txnid = $$payload.ID$$
            | stats count as wcnt by txnid] 
            | join type=left txnid [search index="app_event" eventType="B" payload.type="Other"
            | eval txnid = $$payload.ID$$
            | stats count as othercnt by txnid]
            | table txnid, foocnt, barcnt, hlcnt, wcnt, othercnt

Can someone please help me merge these joins to just one join, or perhaps let me know if there is a better way to go about this whole query.

Thanks.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...