Splunk Search

Why does a join of a search and subsearch on _time with matching values fail?

manus
Communicator

I tried to join a search and subsearch on _time with the join command, but this failed, even though the resulting time values matched. Why did this happen?

Tags (3)
1 Solution

manus
Communicator

A join on _time can fail even if the epoch values match. The failure is caused if one epoch _time value has a numeric format with decimal places and the other does not.

Example:
If on left side, you have _time=1405206000

and on right side, you have _time=1405206000.000

the join will fail, even if on screen you will see the same value on both sides: 2014-07-13 00:00:00

If you first timestamp is always precise to the second and no more, here is how you can make your join safer:

eval _time=round(_time,0) on the right side.

View solution in original post

ppablo
Retired

Just edited the entire post to fit the Q&A format 🙂 Thanks for posting @manus. I think others will find this content useful

Patrick

0 Karma

manus
Communicator

Well yes, initially, I wanted to ask about my problem on joining on time... but then I figured it out, so I thought I would share the reply, even though I don't have a question anymore

0 Karma

manus
Communicator

A join on _time can fail even if the epoch values match. The failure is caused if one epoch _time value has a numeric format with decimal places and the other does not.

Example:
If on left side, you have _time=1405206000

and on right side, you have _time=1405206000.000

the join will fail, even if on screen you will see the same value on both sides: 2014-07-13 00:00:00

If you first timestamp is always precise to the second and no more, here is how you can make your join safer:

eval _time=round(_time,0) on the right side.

lguinn2
Legend

Did you have a question?

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...