Splunk Search

join search with condition

arandy01
Explorer

I have two searches:
search-A gives values like
 

typestatushostnameidportSizebasecache
httpOFFhost-117NANANANA
httpONhost-16NANANANA
httpONhost-115NANANANA
httpOFFhost-11NANANANA
webOFFhost-217NANANANA
webONhost-26NANANANA
httpONhost-315NANANANA
httpOFFhost-31NANANANA

 

Search-B gives value like

typestatushostnameidportSizebasecache
availablenot_processedhost-117NANANANA
availablenot_processedhost-217NANANANA
availablenot_processedhost-415NANANANA
availablenot_processedhost-51NANANANA

 

I want to merge two search in such a way that it can check hostname in search-B and if hostname is present in search-A the it should not join/merge that row.. the result should be something like below...

typestatushostnameidportSizebasecache
httpOFFhost-117NANANANA
httpONhost-16NANANANA
httpONhost-115NANANANA
httpOFFhost-11NANANANA
webOFFhost-217NANANANA
webONhost-26NANANANA
httpONhost-315NANANANA
httpOFFhost-31NANANANA
availablenot_processedhost-415NANANANA
availablenot_processedhost-51NANANANA




Labels (4)
0 Karma
1 Solution

manjunathmeti
Champion

hi @arandy01,
Try this:

 

search-A | append [search search-B] | eventstats count(eval(status IN("ON", "OFF"))) as status_count by hostname | where NOT (status_count!=0 AND status="not_processed")

 

View solution in original post

manjunathmeti
Champion

hi @arandy01,
Try this:

 

search-A | append [search search-B] | eventstats count(eval(status IN("ON", "OFF"))) as status_count by hostname | where NOT (status_count!=0 AND status="not_processed")

 

arandy01
Explorer

Hi @manjunathmeti 
Thanks for the quick reply...
But it does not work... and only shows results from search-A

0 Karma

manjunathmeti
Champion

Updated my answer check now.

arandy01
Explorer

Thanks a lot 🙂
works perfectly 🙂

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...