Splunk Search

help on jointure in appendcols subsearch

jip31
Motivator

Hello

In the search below, I need to do a jointure after the appendcols command like in the first part of the search

 

 

| inputlookup lookup_pana
| rename "name0" as HOSTNAME 
| fields HOSTNAME HealthState0  
| where HealthState0 < 85 
| join HOSTNAME 
    [| inputlookup fo_all where TYPE="In"
    | fields SITE COUNTRY RESPONSIBLE DEPARTMENT HOSTNAME] 
| stats count as NbHostHealthInf85 
| appendcols 
    [| inputlookup fo_all where TYPE="Ind" 
    | fields SITE COUNTRY RESPONSIBLE DEPARTMENT HOSTNAME 
    | stats count as NbIndHost] 

 

So I done this but it doesnt works

| appendcols 
| inputlookup lookup_pana
| rename "name0" as HOSTNAME 
| join HOSTNAME 
    [| inputlookup fo_all where TYPE="Ind" (
    | fields SITE COUNTRY RESPONSIBLE DEPARTMENT HOSTNAME 
    | stats count as NbIndHost] 

How to do this please?

 

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

First, one should avoid joins whenever possible because they are slow.  See the Join section of the Search Reference manual for alternatives.

Second, the join in the second example fails because the subsearch does not return a HOSTNAME field so the join command has nothing to match events with.  The only fields returned by the subsearch are the 'count' and 'NbIndHost' fields from the stats command.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

First, one should avoid joins whenever possible because they are slow.  See the Join section of the Search Reference manual for alternatives.

Second, the join in the second example fails because the subsearch does not return a HOSTNAME field so the join command has nothing to match events with.  The only fields returned by the subsearch are the 'count' and 'NbIndHost' fields from the stats command.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...