Splunk Search

Why are results still coming back blank after using join using multiple source type?

pratibha0610
Explorer

Hi team,

I wonder if someone can help me with the below query.  I have a to combine my two searches with join. With first search i get the assignement group and with second search i get email of those assigment group to send alert. 

i have common values between two sourcetype but field name is different.  in the first serach, field is called dv_name and in second it is called name. Therefore i create name variable before using join. However my field email is still coming blank

 serach:

index=production sourcetype=call
| eval name=dv_name

| join name type=left

[ index=production sourcetype=mail  earliest="04/30/2022:20:00:00" latest=now() | dedup name | stats values (dv_email) values (name) by name]

| eval Email=if(isnull(dv_email), " ", dv_email) 

| table dv_name Email

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Since you are dedup'ing name, there will only be one value (the first) for dv_email so the stats becomes unnecessary. (The reason you were getting no results is that the field created by the stats command is "values(dv_email)" not dv_email - you could fix this (if you still want to use stats) by stats values(dv_email) as dv_email by name.)

index=production sourcetype=call
| eval name=dv_name

| join name type=left

[ index=production sourcetype=mail  earliest="04/30/2022:20:00:00" latest=now() | dedup name]

| eval Email=if(isnull(dv_email), " ", dv_email) 

| table dv_name Email

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Since you are dedup'ing name, there will only be one value (the first) for dv_email so the stats becomes unnecessary. (The reason you were getting no results is that the field created by the stats command is "values(dv_email)" not dv_email - you could fix this (if you still want to use stats) by stats values(dv_email) as dv_email by name.)

index=production sourcetype=call
| eval name=dv_name

| join name type=left

[ index=production sourcetype=mail  earliest="04/30/2022:20:00:00" latest=now() | dedup name]

| eval Email=if(isnull(dv_email), " ", dv_email) 

| table dv_name Email

pratibha0610
Explorer

@ITWhisperer  thanks a lot!! my search worked.

I also wanted to check one thing for setting up alert to send mail to Email address popped in result. Will the below solution work?

Enable send email alert action and in to: field set $result.Email$ 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...