Splunk Search

Why are results still coming back blank after using join using multiple source type?

pratibha0610
Explorer

Hi team,

I wonder if someone can help me with the below query.  I have a to combine my two searches with join. With first search i get the assignement group and with second search i get email of those assigment group to send alert. 

i have common values between two sourcetype but field name is different.  in the first serach, field is called dv_name and in second it is called name. Therefore i create name variable before using join. However my field email is still coming blank

 serach:

index=production sourcetype=call
| eval name=dv_name

| join name type=left

[ index=production sourcetype=mail  earliest="04/30/2022:20:00:00" latest=now() | dedup name | stats values (dv_email) values (name) by name]

| eval Email=if(isnull(dv_email), " ", dv_email) 

| table dv_name Email

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Since you are dedup'ing name, there will only be one value (the first) for dv_email so the stats becomes unnecessary. (The reason you were getting no results is that the field created by the stats command is "values(dv_email)" not dv_email - you could fix this (if you still want to use stats) by stats values(dv_email) as dv_email by name.)

index=production sourcetype=call
| eval name=dv_name

| join name type=left

[ index=production sourcetype=mail  earliest="04/30/2022:20:00:00" latest=now() | dedup name]

| eval Email=if(isnull(dv_email), " ", dv_email) 

| table dv_name Email

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Since you are dedup'ing name, there will only be one value (the first) for dv_email so the stats becomes unnecessary. (The reason you were getting no results is that the field created by the stats command is "values(dv_email)" not dv_email - you could fix this (if you still want to use stats) by stats values(dv_email) as dv_email by name.)

index=production sourcetype=call
| eval name=dv_name

| join name type=left

[ index=production sourcetype=mail  earliest="04/30/2022:20:00:00" latest=now() | dedup name]

| eval Email=if(isnull(dv_email), " ", dv_email) 

| table dv_name Email

pratibha0610
Explorer

@ITWhisperer  thanks a lot!! my search worked.

I also wanted to check one thing for setting up alert to send mail to Email address popped in result. Will the below solution work?

Enable send email alert action and in to: field set $result.Email$ 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...