Splunk Search

Why does a join of a search and subsearch on _time with matching values fail?

manus
Communicator

I tried to join a search and subsearch on _time with the join command, but this failed, even though the resulting time values matched. Why did this happen?

Tags (3)
1 Solution

manus
Communicator

A join on _time can fail even if the epoch values match. The failure is caused if one epoch _time value has a numeric format with decimal places and the other does not.

Example:
If on left side, you have _time=1405206000

and on right side, you have _time=1405206000.000

the join will fail, even if on screen you will see the same value on both sides: 2014-07-13 00:00:00

If you first timestamp is always precise to the second and no more, here is how you can make your join safer:

eval _time=round(_time,0) on the right side.

View solution in original post

ppablo
Retired

Just edited the entire post to fit the Q&A format 🙂 Thanks for posting @manus. I think others will find this content useful

Patrick

0 Karma

manus
Communicator

Well yes, initially, I wanted to ask about my problem on joining on time... but then I figured it out, so I thought I would share the reply, even though I don't have a question anymore

0 Karma

manus
Communicator

A join on _time can fail even if the epoch values match. The failure is caused if one epoch _time value has a numeric format with decimal places and the other does not.

Example:
If on left side, you have _time=1405206000

and on right side, you have _time=1405206000.000

the join will fail, even if on screen you will see the same value on both sides: 2014-07-13 00:00:00

If you first timestamp is always precise to the second and no more, here is how you can make your join safer:

eval _time=round(_time,0) on the right side.

lguinn2
Legend

Did you have a question?

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...