need help with joining two queries

[pench2k19]

Hi ninjas,

i have two queries with ] the output as follows

query1 output fields:

SOR filename expected_time
1ci extract 12:30:00 10-5-2019

query2 output fields:
SOR ** filename** real_time
1art congig 01:30:00 10-5-2019

The second query values are subset of first query.

Now i want to print the values of SOR , filename and expected_time when there is no real_time value in the second query.

can you please help here.

@jkat54 @vnravikumar @somesoni2 @woodcock

[woodcock]

I cannot help unless you show us the 2 searches (the SPL).

[MuS]

Hi pench2k19,

best option is to forget about join completely for reasons.

Just use a plain stats instead:

 query1 OR query2 | stats values(*) AS * by SOR

this works best, and you will not hit any hidden limits 😉

Learn more over here https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo...

cheers, MuS

[pench2k19]

Hi @MuS

Thanks for the response.

It's not working unfortunately.

Let me tell the clear requirement here... I need the SOR, Filename, expected_time values when there is no arrival time. Can you please suggest me the alternative way

Unfortunately I m not able copy my query here.

[pench2k19]

To give you more context, in the first query I have loopkup file as data source and in the second query I mean using real time logs.

[pench2k19]

Hi @MuS

Thanks for the reply.

Unfortunately your solution is not working in my case.

[MuS]

I'm pretty sure it would if you could provide more context, and some sample events 😉

[koshyk]

I'm not clear on your query, if you need a lookup or join or transaction between the queries

Just a guess, Is this what you are expecting? The below should print fields irrespective of and if SOR is both the same, it will print the join

<query1> 
| join type=left SOR [|<query2>]