Splunk Search

Why do I get a 400 stanza error when using a join command in searches?

tb5821
Communicator

I tried to add a simple join onto my search but Splunk throws a 400 error

{"messages":[{"type":"FATAL","text":"Missing or malformed messages.conf stanza for SEARCHFACTORY:UNKNOWN_OP__namespace"}]}

<Search>
| eventstats earliest(count) as earliest_count,earliest(_time) as earliest_time,latest(_time) as latest_time, latest(count) as latest_count by namespace
| where latest_count=earliest_count
| eval l_time=strftime(latest_time,"%m/%d/%y %H:%M:%S")
| eval e_time=strftime(earliest_time,"%m/%d/%y %H:%M:%S")
| eval time_since_last = latest_time - earliest_time
| fieldformat time_since_last = tostring(time_since_last, "duration")
| join namespace
    [source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s 
    | eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]
Tags (3)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try adding the search command to the join.

... | join namespace
     [search source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s 
     | eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]
---
If this reply helps you, Karma would be appreciated.

View solution in original post

inventsekar
Ultra Champion

i hope this issue is not related to join command..
In the middle of the SPL, we can not have this [source=abc .... ],

with a search command, it will become a complete SPL..

join namespace [source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s
| eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try adding the search command to the join.

... | join namespace
     [search source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s 
     | eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]
---
If this reply helps you, Karma would be appreciated.

inventsekar
Ultra Champion

i hope this issue is not related to join command..
In the middle of the SPL, we can not have this [source=abc .... ],

with a search command, it will become a complete SPL..

join namespace [source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s
| eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Searches/subsearches need to start with a command. "source" is not a command, but search is. There is an implicit search at the beginning of every query, but not in subsearches.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...