Splunk Search

join search with condition

arandy01
Explorer

I have two searches:
search-A gives values like
 

typestatushostnameidportSizebasecache
httpOFFhost-117NANANANA
httpONhost-16NANANANA
httpONhost-115NANANANA
httpOFFhost-11NANANANA
webOFFhost-217NANANANA
webONhost-26NANANANA
httpONhost-315NANANANA
httpOFFhost-31NANANANA

 

Search-B gives value like

typestatushostnameidportSizebasecache
availablenot_processedhost-117NANANANA
availablenot_processedhost-217NANANANA
availablenot_processedhost-415NANANANA
availablenot_processedhost-51NANANANA

 

I want to merge two search in such a way that it can check hostname in search-B and if hostname is present in search-A the it should not join/merge that row.. the result should be something like below...

typestatushostnameidportSizebasecache
httpOFFhost-117NANANANA
httpONhost-16NANANANA
httpONhost-115NANANANA
httpOFFhost-11NANANANA
webOFFhost-217NANANANA
webONhost-26NANANANA
httpONhost-315NANANANA
httpOFFhost-31NANANANA
availablenot_processedhost-415NANANANA
availablenot_processedhost-51NANANANA




Labels (4)
0 Karma
1 Solution

manjunathmeti
Champion

hi @arandy01,
Try this:

 

search-A | append [search search-B] | eventstats count(eval(status IN("ON", "OFF"))) as status_count by hostname | where NOT (status_count!=0 AND status="not_processed")

 

View solution in original post

manjunathmeti
Champion

hi @arandy01,
Try this:

 

search-A | append [search search-B] | eventstats count(eval(status IN("ON", "OFF"))) as status_count by hostname | where NOT (status_count!=0 AND status="not_processed")

 

arandy01
Explorer

Hi @manjunathmeti 
Thanks for the quick reply...
But it does not work... and only shows results from search-A

0 Karma

manjunathmeti
Champion

Updated my answer check now.

arandy01
Explorer

Thanks a lot 🙂
works perfectly 🙂

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

    Thursday, June 25, 2026  |  11AM PDT / 2PM EDT  Duration: 1 Hour (Includes live Q&A) Register to ...

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...