Splunk Search

Search with two "join"

MaximeM
Explorer

Hi everyone !
I try to get some values from different searches using "join".
Here is my search command :

 host="yvas7300" sourcetype="accesslog" type_op="srch" conn="22" op="5" timestamp="27/Sep/2012:01:33:57" | eval tm=timestamp
| join host [search sourcetype="errorslog" type="started" timestamp<=tm | sort -timestamp | head 1 | eval tmstarted=timestamp | fields host tmstarted]
| join host conn [search sourcetype="accesslog" type_op="bind" timestamp>=tmstarted timestamp<=tm | fields host conn dn]

First, i get a specific event and I save its time (tm), then I get the time when my server is starting (tmstarted), and finally I want to get some values from an event of type "bind" with the same connection number of the first event, between tmstarted and tm.

But it seems that the last join can't access to "tmstarted". When I replace "tmstarted" by its value (for example : timestamp>="27/Sep/2012:00:00:00"), the command works correctly, but I got nothing when I do "timestamp>=tmstarted".

Can someone help me please ?

0 Karma

yannK
Splunk Employee
Splunk Employee

Each search populating a JOIN is like a subsearch, it run's separately from the other searches.
So the field tm created in the main search is not present in the first JOIN.
and the field tmstarted created in the first JOIN is not present in the second JOIN.

I don't see how to achieve what you want to do using JOIN.
you could use a transaction instead, or multiple searches with passing time conditions, see
http://splunk-base.splunk.com/answers/9940/search-for-events-that-happened-around-the-time-of-other-...

Ayn
Legend

Subsearches run on their own, so I highly doubt you're able to access a field you've created in an outer search, unless that field existed before that in some other form.

0 Karma

MaximeM
Explorer

Thanks for your answer.
Actually, I can access to the field "tm" in both JOINs. And if I correctly understood the transaction command, I can't use it on events with different sourcetypes.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...