Splunk Search

how to replace join?

priyastalin
Explorer

Hi,  @493669  @MuS  @dturnbull_splun  @bowesmana 

Anyone please help me in replacing join in the below query??

" index=167515-np sourcetype=hardware
| fields deviceId, productType, productId, physicalType
| search physicalType=Chassis
| dedup deviceId
| join deviceId [ search index=167515-np [| `last_np_sourcetype( "index=167515-np", "group_members")` ] groupId=288348 | fields deviceId ]
| stats dc(productId) as PIDs by productType
| search productType=Routers
| table PIDs"

Thanks

Labels (1)
0 Karma

to4kawa
Ultra Champion

fixed sample:

 

(index=167515-np sourcetype=hardware physicalType=Chassis) OR (index=167515-np 
    [| `last_np_sourcetype( "index=167515-np", "group_members")` ] groupId=288348 )
| fields deviceId, productType, productId, physicalType, sourcetype 
| stats values(*) as * dc(sourcetype) as flag by deviceId
| where flag > 1
| stats dc(productId) as PIDs by productType 
| search productType=Routers 
| table PIDs

 

 

0 Karma

priyastalin
Explorer

Hi @to4kawa ,

I didn't get output for this, Could you please help me in solving this?

 

0 Karma

to4kawa
Ultra Champion

I made a mistake and fixed it.

0 Karma

priyastalin
Explorer

Hi @to4kawa ,

Couldn't see your solution can you send me again?

Thanks

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...