Search with two "join"

[MaximeM]

Hi everyone !
I try to get some values from different searches using "join".
Here is my search command :

 host="yvas7300" sourcetype="accesslog" type_op="srch" conn="22" op="5" timestamp="27/Sep/2012:01:33:57" | eval tm=timestamp
| join host [search sourcetype="errorslog" type="started" timestamp<=tm | sort -timestamp | head 1 | eval tmstarted=timestamp | fields host tmstarted]
| join host conn [search sourcetype="accesslog" type_op="bind" timestamp>=tmstarted timestamp<=tm | fields host conn dn]

First, i get a specific event and I save its time (tm), then I get the time when my server is starting (tmstarted), and finally I want to get some values from an event of type "bind" with the same connection number of the first event, between tmstarted and tm.

But it seems that the last join can't access to "tmstarted". When I replace "tmstarted" by its value (for example : timestamp>="27/Sep/2012:00:00:00"), the command works correctly, but I got nothing when I do "timestamp>=tmstarted".

Can someone help me please ?

[yannK]

Each search populating a JOIN is like a subsearch, it run's separately from the other searches.
So the field tm created in the main search is not present in the first JOIN.
and the field tmstarted created in the first JOIN is not present in the second JOIN.

I don't see how to achieve what you want to do using JOIN.
you could use a transaction instead, or multiple searches with passing time conditions, see
http://splunk-base.splunk.com/answers/9940/search-for-events-that-happened-around-the-time-of-other-...

[Ayn]

Subsearches run on their own, so I highly doubt you're able to access a field you've created in an outer search, unless that field existed before that in some other form.

[MaximeM]

Thanks for your answer.
Actually, I can access to the field "tm" in both JOINs. And if I correctly understood the transaction command, I can't use it on events with different sourcetypes.