Splunk search join

[Ponczi1]

Hello,

I am trying to join two searches so i could get number of declined transactions in time. First i look for inbound messages to get an IDs (it's in txRef tag) of special kinds transactions and then I am looking for outbound messages of all declined transaction to join them together based on the IDs

The search I am using looks like this but it is not working correctly.

index=Auth AuthorizeTransaction Inbound Message "<alias" NOT "<ticket" 
| regex "<txRef>(?<TXREF>\d+)<" 
| eval txRefs = TXREF
| join type=inner txRefs [search index=Auth Outbound Message "declined" | regex "<txRef>(?<TXREF>\d+)</txRef>" | eval txRefs=TXREF]
| timechart span=1h count as "Declined transactions"

EDIT

I have found what i was doing wrong. Apprently i was using Regex instead of Rex so i did not really extract the fields 🙂

[mayurr98 · Accepted solution]

Try this:

index=Auth AuthorizeTransaction Inbound Message "<alias" NOT "<ticket" 
 | rex field=_raw "\<txRef\>(?<TXREF>\d+)\<\/txRef\>" 
 | eval txRefs = TXREF
 | join type=inner txRefs [search index=Auth Outbound Message "declined" | rex field=_raw "\<txRef\>(?<TXREF>\d+)\<\/txRef\>" | eval txRefs=TXREF]
 | timechart span=1h count as "Declined transactions"

Let me know if this helps!

[Ponczi1]

Yeah i figured that "rex" was the problem. But thanks a lot anyway!

[nickhills]

That's good news. Ideally you should post an answer and accept it yourself, so that other people can see that you resolved it, and how. You can also upvote any answer or comments who helped you!

[mayurr98]

will you please enter your code in 101010 written below text box as there are some escape characters in your query

[Ponczi1]

Sure, sorry