Splunk Search

how to replace join?

priyastalin
Explorer

Hi,  @493669  @MuS  @dturnbull_splun  @bowesmana 

Anyone please help me in replacing join in the below query??

" index=167515-np sourcetype=hardware
| fields deviceId, productType, productId, physicalType
| search physicalType=Chassis
| dedup deviceId
| join deviceId [ search index=167515-np [| `last_np_sourcetype( "index=167515-np", "group_members")` ] groupId=288348 | fields deviceId ]
| stats dc(productId) as PIDs by productType
| search productType=Routers
| table PIDs"

Thanks

Labels (1)
0 Karma

to4kawa
SplunkTrust
SplunkTrust

fixed sample:

 

(index=167515-np sourcetype=hardware physicalType=Chassis) OR (index=167515-np 
    [| `last_np_sourcetype( "index=167515-np", "group_members")` ] groupId=288348 )
| fields deviceId, productType, productId, physicalType, sourcetype 
| stats values(*) as * dc(sourcetype) as flag by deviceId
| where flag > 1
| stats dc(productId) as PIDs by productType 
| search productType=Routers 
| table PIDs

 

 

0 Karma

priyastalin
Explorer

Hi @to4kawa ,

I didn't get output for this, Could you please help me in solving this?

 

0 Karma

to4kawa
SplunkTrust
SplunkTrust

I made a mistake and fixed it.

0 Karma

priyastalin
Explorer

Hi @to4kawa ,

Couldn't see your solution can you send me again?

Thanks

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!