Splunk Search

Why are results still coming back blank after using join using multiple source type?

pratibha0610
Explorer

Hi team,

I wonder if someone can help me with the below query.  I have a to combine my two searches with join. With first search i get the assignement group and with second search i get email of those assigment group to send alert. 

i have common values between two sourcetype but field name is different.  in the first serach, field is called dv_name and in second it is called name. Therefore i create name variable before using join. However my field email is still coming blank

 serach:

index=production sourcetype=call
| eval name=dv_name

| join name type=left

[ index=production sourcetype=mail  earliest="04/30/2022:20:00:00" latest=now() | dedup name | stats values (dv_email) values (name) by name]

| eval Email=if(isnull(dv_email), " ", dv_email) 

| table dv_name Email

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Since you are dedup'ing name, there will only be one value (the first) for dv_email so the stats becomes unnecessary. (The reason you were getting no results is that the field created by the stats command is "values(dv_email)" not dv_email - you could fix this (if you still want to use stats) by stats values(dv_email) as dv_email by name.)

index=production sourcetype=call
| eval name=dv_name

| join name type=left

[ index=production sourcetype=mail  earliest="04/30/2022:20:00:00" latest=now() | dedup name]

| eval Email=if(isnull(dv_email), " ", dv_email) 

| table dv_name Email

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Since you are dedup'ing name, there will only be one value (the first) for dv_email so the stats becomes unnecessary. (The reason you were getting no results is that the field created by the stats command is "values(dv_email)" not dv_email - you could fix this (if you still want to use stats) by stats values(dv_email) as dv_email by name.)

index=production sourcetype=call
| eval name=dv_name

| join name type=left

[ index=production sourcetype=mail  earliest="04/30/2022:20:00:00" latest=now() | dedup name]

| eval Email=if(isnull(dv_email), " ", dv_email) 

| table dv_name Email

pratibha0610
Explorer

@ITWhisperer  thanks a lot!! my search worked.

I also wanted to check one thing for setting up alert to send mail to Email address popped in result. Will the below solution work?

Enable send email alert action and in to: field set $result.Email$ 

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...