Splunk Search

Search with two "join"

MaximeM
Explorer

Hi everyone !
I try to get some values from different searches using "join".
Here is my search command :

 host="yvas7300" sourcetype="accesslog" type_op="srch" conn="22" op="5" timestamp="27/Sep/2012:01:33:57" | eval tm=timestamp
| join host [search sourcetype="errorslog" type="started" timestamp<=tm | sort -timestamp | head 1 | eval tmstarted=timestamp | fields host tmstarted]
| join host conn [search sourcetype="accesslog" type_op="bind" timestamp>=tmstarted timestamp<=tm | fields host conn dn]

First, i get a specific event and I save its time (tm), then I get the time when my server is starting (tmstarted), and finally I want to get some values from an event of type "bind" with the same connection number of the first event, between tmstarted and tm.

But it seems that the last join can't access to "tmstarted". When I replace "tmstarted" by its value (for example : timestamp>="27/Sep/2012:00:00:00"), the command works correctly, but I got nothing when I do "timestamp>=tmstarted".

Can someone help me please ?

0 Karma

yannK
Splunk Employee
Splunk Employee

Each search populating a JOIN is like a subsearch, it run's separately from the other searches.
So the field tm created in the main search is not present in the first JOIN.
and the field tmstarted created in the first JOIN is not present in the second JOIN.

I don't see how to achieve what you want to do using JOIN.
you could use a transaction instead, or multiple searches with passing time conditions, see
http://splunk-base.splunk.com/answers/9940/search-for-events-that-happened-around-the-time-of-other-...

Ayn
Legend

Subsearches run on their own, so I highly doubt you're able to access a field you've created in an outer search, unless that field existed before that in some other form.

0 Karma

MaximeM
Explorer

Thanks for your answer.
Actually, I can access to the field "tm" in both JOINs. And if I correctly understood the transaction command, I can't use it on events with different sourcetypes.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...