join command in splunk

[splunkn]

Hi ,

I need to extract the host list which are belonging to certain applications ( Listed in my Lookup table )
Need to find which hosts are getting connected to Deployment server and after that need to pick out the hosts which are present in the lookup table. I have used join in my query. It works fine.

index=internal host=abcsdf "/services/broker/phonehome/connection" | rex "(?i)^(?:[^.]*.){10}\d+(?P<remote_host>.+?)" | rex "(?i).com(?P<remote_host>.+?)_" | dedup remote_host |rename remote_host as hostname| join hostname[|inputlookup applist] | stats distinct_count(hostname)

Any alternate idea to this?
Will join consume more time to run?

Thanks in advance

[stephanefotso]

Yes join consume more time to run. I think you will be interested by the link bellow:

http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi...

[splunkn]

Stephane,,
Many Thanks and could you please explain a bit to compare events with lookup table as in my scenario.

[stephanefotso]

ok. in your case that is what you could do to avoid join:

index=internal host=abcsdf "/services/broker/phonehome/connection" | rex "(?i)^(?:[^.]*.){10}d+(?P<remote_host>.+?)" | rex "(?i).com(?P<remote_host>.+?)_" | dedup remote_host |rename remote_host as hostname| lookup applist.csv hostname| stats distinct_count(hostname)