Splunk Search

What is the right way to Join?

rochapablo
Engager

I've been searching how to join, but every example that I apply seems to be wrong.

I've got referents type of log:

app=my_app_name INFO controller=MyController method=myMethod transaction=999
app=my_app_name INFO controller=MyOtherController transaction_id=999
app=my_app_name INFO controller=CheckoutController params[transaction_id]=999

As you can see, I always have the transaction id in different keys.

So I'm trying to join like this:

index=my_app_name | join "params[transaction_id]" [ search  index=my_app_name transaction_id ] | fields controller

But like i said, it seems not to be working, because I've always got some result rows that don't make sense, like:

app=my_app_name INFO controller=CheckoutController order_id=99
Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

... | rex "params\[transaction_id\]=(?<transaction_id>\d+)" | stats values(*) AS * by transaction_id

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Here's a pretty good writeup to get you started on not joining at all: http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi...

0 Karma

woodcock
Esteemed Legend

Try this:

... | rex "params\[transaction_id\]=(?<transaction_id>\d+)" | stats values(*) AS * by transaction_id
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...