Splunk Search

Self Join Statement does not work

shayhk
Explorer

Self Join Statement does not work

Host Demo

RequestID | Method | Type

111 Method_X 1

222 Method_T 1

111 Method_Q 2

233 Method_R 1

As a result

i am looking for the flow of RequestID=111

RequestID | Method1 | Method2

111 Method_X Method_Q

Search code- not working:

host=Demo

| table RequestID Method

| where RequestID =111 and Type=1

| rename Method as Method1

| selfjoin RequestID
[
table RequestID Method
| where RequestID =111 and Type=2
| rename Method as Method2
]

|table RequestID Method1 Method2

looking for a solution

Thanks
shay

0 Karma

somesoni2
Revered Legend

First, the output you're looking for is not possible with self-join. Secondly, the self join syntax you're using is incorrect. The correct syntax is as follows:

Your search | selfjoin <selfjoin optoins> <join field name(s)>

What you're looking for can done by normal join as follows

host=Demo| table RequestID Method| where  RequestID =111 and Type=1| rename Method as Method1| join RequestID [search host=demo| table RequestID Method  | where  RequestID =111 and Type=2
  | rename Method as Method2]|table RequestID Method1 Method2 

shayhk
Explorer

It's working
Thanks

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...