I have 2 large data sets Data Set 1 (Assets) contains information about devices. For example the dataset will have the following fields hostname ipaddress status parent Data Set 2 (Sof...
See more...
I have 2 large data sets Data Set 1 (Assets) contains information about devices. For example the dataset will have the following fields hostname ipaddress status parent Data Set 2 (Software) contains software installed for those devices (I did a check on the number of events and there is somewhere around 4.5 million events returned over a 24h window). For example the dataset will have the following fields machine_name sw_installed installed_date What I am working on is to join these 2 data sets based on the machine_name / host name. I am then specifically looking for specific software and doing a match if found. A simple join here would be something like (the following example shows 1 eval, but this could conceivably be 2,3 or more depending on the requirement) index=assets | dedup host_name | rename host_name AS machine_name
| join machine_name
[search index=software | fields matchine_name sw_installed]
| eval jobinstalled=if(match(sw_installed,"jobsw"),"Yes","No")
| table machine_name jobinstalled If I then change this search to be a little more specific index=assets host_name=mysrv1 | dedup host_name | rename host_name AS machine_name
| join machine_name
[search index=software | fields matchine_name sw_installed]
| eval jobinstalled=if(match(sw_installed,"jobsw"),"Yes","No")
| table machine_name jobinstalled I get maybe 1 result or maybe a couple of nothing at all. I know the reason why and this is due to hitting the maximum of 50000 returned events in my subsearch (the finished job drop down shows subsearch produced 50000 results truncating to maxout 50000. If I configure with a max=0 I run into the similar problem and again my results are skewed index=assets host_name=mysrv1 | dedup host_name | rename host_name AS machine_name
| join machine_name max=0
[search index=software | fields matchine_name sw_installed]
| eval jobinstalled=if(match(sw_installed,"jobsw"),"Yes","No")
| table machine_name jobinstalled If I write the following SPL index=software machine_name=mysrv1
| dedup sw_installed
| table sw_installed machine_name that search will produce for example 90 events for the software installed on the server. If I run the following search for example index=assets host_name=mysrv1 | dedup host_name I will get the 1 events as intended. How do I fix my search so that I can get around this constraint?