Splunk Search

left join not returning all results

asharm65
New Member

Hi,

i am joining two queries which results in some blank values,but when the sub-search is ran independently there is no blank value .

This is the query.

`url-endpoints`
| lookup endpoint-lookup.csv "Endpoint Name" as endpoint OUTPUT "Endpoint ID" as EndpointID "API Type" as "API Type"
| where isnotnull(EndpointID)| eval Date = strftime(_time, "%d/%m/%y"), hrs=strftime(_time,"%H:%M:%S.%Q"), CNC=case(hrs>="06:00:00" AND hrs<="23:59:59", "Core Hours (06.00 - 00.00)", hrs>="00:00:00" AND hrs<"06:00:00", "Non Core Hours (00.00 - 06.00)")| eval "ASPSP Brand ID"="3"|search CNC=*|dedup CNC "ASPSP Brand ID" EndpointID Date|table Date EndpointID CNC "ASPSP Brand ID"
|join type=left Date EndpointID CNC "ASPSP Brand ID"[search `url-endpoints`
| lookup endpoint-lookup.csv "Endpoint Name" as endpoint OUTPUT "Endpoint ID" as EndpointID "API Type" as "API Type"
| where isnotnull(EndpointID) |eval filter=case(request_processing_time=="-1","no",response_processing_time=="-1","no",target_processing_time=="-1","no")|where isnull(filter) 
| eval Date = strftime(_time, "%d/%m/%y"), hrs=strftime(_time,"%H:%M:%S.%Q"), CNC=case(hrs>="06:00:00" AND hrs<="23:59:59", "Core Hours (06.00 - 00.00)", hrs>="00:00:00" AND hrs<"06:00:00", "Non Core Hours (00.00 - 06.00)"), first_byte = 'request_processing_time' + 'response_processing_time' + 'target_processing_time', "ASPSP Brand ID"="3"
| stats median(first_byte) as median_first_byte median(sent_bytes) as median_reponse_payload by Date "ASPSP Brand ID" EndpointID CNC
| eval median_first_byte = round(median_first_byte*1000, 2)|table Date "ASPSP Brand ID" EndpointID CNC median_first_byte median_reponse_payload]|table Date "ASPSP Brand ID" EndpointID CNC median_first_byte median_reponse_payload

results in:
alt text

but when the sub-search is ran independently it give results like:

alt text

what could be the prblm here????

Thanks in Advance!!!!

Tags (1)
0 Karma

KailA
Contributor

Does your subsearch returns more than 50000 events ?
Did you check the job inspector? Sometime your subsearch can also expire.
Let me know about that 🙂

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!