Splunk Search
Highlighted

join command in splunk

Communicator

Hi ,

I need to extract the host list which are belonging to certain applications ( Listed in my Lookup table )
Need to find which hosts are getting connected to Deployment server and after that need to pick out the hosts which are present in the lookup table. I have used join in my query. It works fine.

index=internal host=abcsdf "/services/broker/phonehome/connection" | rex "(?i)^(?:[^.]*.){10}\d+(?P<remotehost>.+?)" | rex "(?i).com(?P<remotehost>.+?)" | dedup remotehost |rename remotehost as hostname| join hostname[|inputlookup applist] | stats distinctcount(hostname)

Any alternate idea to this?
Will join consume more time to run?

Thanks in advance

Tags (1)
0 Karma
Highlighted

Re: join command in splunk

Motivator

Yes join consume more time to run. I think you will be interested by the link bellow:

http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi...

0 Karma
Highlighted

Re: join command in splunk

Communicator

Stephane,,
Many Thanks and could you please explain a bit to compare events with lookup table as in my scenario.

0 Karma
Highlighted

Re: join command in splunk

Motivator

ok. in your case that is what you could do to avoid join:

index=internal host=abcsdf "/services/broker/phonehome/connection" | rex "(?i)^(?:[^.]*.){10}d+(?P<remotehost>.+?)" | rex "(?i).com(?P<remotehost>.+?)" | dedup remotehost |rename remotehost as hostname| lookup applist.csv hostname| stats distinctcount(hostname)

0 Karma