Splunk Search

join search with condition

arandy01
Explorer

I have two searches:
search-A gives values like
 

typestatushostnameidportSizebasecache
httpOFFhost-117NANANANA
httpONhost-16NANANANA
httpONhost-115NANANANA
httpOFFhost-11NANANANA
webOFFhost-217NANANANA
webONhost-26NANANANA
httpONhost-315NANANANA
httpOFFhost-31NANANANA

 

Search-B gives value like

typestatushostnameidportSizebasecache
availablenot_processedhost-117NANANANA
availablenot_processedhost-217NANANANA
availablenot_processedhost-415NANANANA
availablenot_processedhost-51NANANANA

 

I want to merge two search in such a way that it can check hostname in search-B and if hostname is present in search-A the it should not join/merge that row.. the result should be something like below...

typestatushostnameidportSizebasecache
httpOFFhost-117NANANANA
httpONhost-16NANANANA
httpONhost-115NANANANA
httpOFFhost-11NANANANA
webOFFhost-217NANANANA
webONhost-26NANANANA
httpONhost-315NANANANA
httpOFFhost-31NANANANA
availablenot_processedhost-415NANANANA
availablenot_processedhost-51NANANANA




Labels (4)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @arandy01,
Try this:

 

search-A | append [search search-B] | eventstats count(eval(status IN("ON", "OFF"))) as status_count by hostname | where NOT (status_count!=0 AND status="not_processed")

 

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

hi @arandy01,
Try this:

 

search-A | append [search search-B] | eventstats count(eval(status IN("ON", "OFF"))) as status_count by hostname | where NOT (status_count!=0 AND status="not_processed")

 

arandy01
Explorer

Hi @manjunathmeti 
Thanks for the quick reply...
But it does not work... and only shows results from search-A

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Updated my answer check now.

arandy01
Explorer

Thanks a lot 🙂
works perfectly 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...