Splunk Search

Why do I get a 400 stanza error when using a join command in searches?

tb5821
Communicator

I tried to add a simple join onto my search but Splunk throws a 400 error

{"messages":[{"type":"FATAL","text":"Missing or malformed messages.conf stanza for SEARCHFACTORY:UNKNOWN_OP__namespace"}]}

<Search>
| eventstats earliest(count) as earliest_count,earliest(_time) as earliest_time,latest(_time) as latest_time, latest(count) as latest_count by namespace
| where latest_count=earliest_count
| eval l_time=strftime(latest_time,"%m/%d/%y %H:%M:%S")
| eval e_time=strftime(earliest_time,"%m/%d/%y %H:%M:%S")
| eval time_since_last = latest_time - earliest_time
| fieldformat time_since_last = tostring(time_since_last, "duration")
| join namespace
    [source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s 
    | eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]
Tags (3)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try adding the search command to the join.

... | join namespace
     [search source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s 
     | eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]
---
If this reply helps you, Karma would be appreciated.

View solution in original post

inventsekar
Super Champion

i hope this issue is not related to join command..
In the middle of the SPL, we can not have this [source=abc .... ],

with a search command, it will become a complete SPL..

join namespace [source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s
| eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]

>>> Happy Splunking !
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try adding the search command to the join.

... | join namespace
     [search source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s 
     | eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]
---
If this reply helps you, Karma would be appreciated.

inventsekar
Super Champion

i hope this issue is not related to join command..
In the middle of the SPL, we can not have this [source=abc .... ],

with a search command, it will become a complete SPL..

join namespace [source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s
| eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]

>>> Happy Splunking !
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Searches/subsearches need to start with a command. "source" is not a command, but search is. There is an implicit search at the beginning of every query, but not in subsearches.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...