Splunk Search

Why am I not able to join my search?

splunker9999
Path Finder

Hi,

Why we are not able to join my search? Can you please suggest how to edit this?

index=idx* sourcetype=Uptime host="*bd*" SystemUpTime>300
| eval difference=(_time - SystemUpTime)
| eval c_time=strftime(difference,"%Y-%m-%d %H:%M:%S")
|join host [search index=idx2_* sourcetype=ps1 |dedup host ]|table host c_time cluster
0 Karma

sundareshr
Legend

Try selfjoin

index=idx* sourcetype=Uptime host="*bd*" SystemUpTime>300
 | eval difference=(_time - SystemUpTime)
 | eval c_time=strftime(difference,"%Y-%m-%d %H:%M:%S")
 |selfjoin host [search index=idx2_* sourcetype=ps1 |dedup host ]|table host c_time cluster
0 Karma

splunker9999
Path Finder

Is there any other we can join this, join taking long time to give results.?

0 Karma

sundareshr
Legend

I would recommed a two-part search.

1) Create a lookup table OR kvstore, with only the hosts from your subsearch. Like this

index=idx2_* sourcetype=ps1 |dedup host | table host cluster | outputlookup hostlist.csv 

You can schedule this to run at a certain frequency (how often do you add new hosts). You can the use this lookup to append cluster info, like this. You could also add the cluster info as an automatic lookup

index=idx* sourcetype=Uptime host="*bd*" SystemUpTime>300
  | eval difference=(_time - SystemUpTime)
  | eval c_time=strftime(difference,"%Y-%m-%d %H:%M:%S")
  | lookup hostlist.csv host OUTPUT cluster 
  | table host cluster

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Outputlookup
http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Lookup

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...