Splunk Search

Why do I get a 400 stanza error when using a join command in searches?

tb5821
Communicator

I tried to add a simple join onto my search but Splunk throws a 400 error

{"messages":[{"type":"FATAL","text":"Missing or malformed messages.conf stanza for SEARCHFACTORY:UNKNOWN_OP__namespace"}]}

<Search>
| eventstats earliest(count) as earliest_count,earliest(_time) as earliest_time,latest(_time) as latest_time, latest(count) as latest_count by namespace
| where latest_count=earliest_count
| eval l_time=strftime(latest_time,"%m/%d/%y %H:%M:%S")
| eval e_time=strftime(earliest_time,"%m/%d/%y %H:%M:%S")
| eval time_since_last = latest_time - earliest_time
| fieldformat time_since_last = tostring(time_since_last, "duration")
| join namespace
    [source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s 
    | eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]
Tags (3)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try adding the search command to the join.

... | join namespace
     [search source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s 
     | eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]
---
If this reply helps you, Karma would be appreciated.

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

i hope this issue is not related to join command..
In the middle of the SPL, we can not have this [source=abc .... ],

with a search command, it will become a complete SPL..

join namespace [source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s
| eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try adding the search command to the join.

... | join namespace
     [search source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s 
     | eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]
---
If this reply helps you, Karma would be appreciated.

inventsekar
SplunkTrust
SplunkTrust

i hope this issue is not related to join command..
In the middle of the SPL, we can not have this [source=abc .... ],

with a search command, it will become a complete SPL..

join namespace [source="/var/log/lag/mongostats.txt" namespace=* earliest=-12h@s
| eval namespace=trim(replace(namespace,"vodcoe-vdm.",""))]

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Searches/subsearches need to start with a command. "source" is not a command, but search is. There is an implicit search at the beginning of every query, but not in subsearches.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...