Splunk Search

Why does a join of a search and subsearch on _time with matching values fail?

manus
Communicator

I tried to join a search and subsearch on _time with the join command, but this failed, even though the resulting time values matched. Why did this happen?

Tags (3)
1 Solution

manus
Communicator

A join on _time can fail even if the epoch values match. The failure is caused if one epoch _time value has a numeric format with decimal places and the other does not.

Example:
If on left side, you have _time=1405206000

and on right side, you have _time=1405206000.000

the join will fail, even if on screen you will see the same value on both sides: 2014-07-13 00:00:00

If you first timestamp is always precise to the second and no more, here is how you can make your join safer:

eval _time=round(_time,0) on the right side.

View solution in original post

ppablo
Retired

Just edited the entire post to fit the Q&A format 🙂 Thanks for posting @manus. I think others will find this content useful

Patrick

0 Karma

manus
Communicator

Well yes, initially, I wanted to ask about my problem on joining on time... but then I figured it out, so I thought I would share the reply, even though I don't have a question anymore

0 Karma

manus
Communicator

A join on _time can fail even if the epoch values match. The failure is caused if one epoch _time value has a numeric format with decimal places and the other does not.

Example:
If on left side, you have _time=1405206000

and on right side, you have _time=1405206000.000

the join will fail, even if on screen you will see the same value on both sides: 2014-07-13 00:00:00

If you first timestamp is always precise to the second and no more, here is how you can make your join safer:

eval _time=round(_time,0) on the right side.

lguinn2
Legend

Did you have a question?

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...