Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: join on 2 fields
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a list of servers, osname & version and a lookup with products, versions and end-of-support dates. Each product (Operating system in this case, has an entry per version. So version 4 of a certain OS has it's own out-of-support date, version 5 another supportdate. etc.
I would like to create an overview, and tell of each server what it's suspected out-of-support-date will be, based on it's os AND version.
The problem is that I can join the two, but it will only match on the product name (first one). Now every server has the same out-of-support date, regardless of it's version.
So, how can I join on two fields, instead of just one? I tried join Product, Version [ | inputlookup .. already, but without success.
Any help appreciated!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What are you what to do is this?
your search * | table Product, Version | join Product [ | inputlookup | eval LastVersion=Version | table Product LastVersion]
than you can compare the different versions
where Version!=LastVersion
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't know why, but when I reverse the join it seems to work.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
But join has limits that stats does not. You may not notice clearly enough to regret this approach!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Like this:
... | stats values(*) AS * BY Product Version
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Make Your Machine Data AI-Ready in Splunk
Splunk Asynchronous Forwarding Explained
How to Monitor AI Agents with Splunk Agent Observability
