I have read through almost every Join label topic on the Splunk Community page and I don't seem to see one that fits my problem. If there is one that works for this issue, please simply direct me to...
See more...
I have read through almost every Join label topic on the Splunk Community page and I don't seem to see one that fits my problem. If there is one that works for this issue, please simply direct me to the correct discussion. The closest discussion that looks like what I am shooting for is: How to join two searches on a common field where the value of the left search matches all values of the right search? But this discussion doesn't have a solution. And I've been through the docs.splunk.com pages reviewing the subsearch, append, appendcols, join and selfjoin. The two searches I would like to join are: Search 1: index="_internal" source="*metrics.log" per_index_thruput series=autoshell host=lelsplunkix* | eval GB=kb/(1024*1024) | timechart span=12h sum(GB) as GB by series Results: (example - 500k+ rows returned) _time _raw sourcetype GB 2020-08-18 07:04:33.307 ABC ship 0.0000264551490559 2020-08-18 07:04:31.168 LMN rum 0.0000000828877091 2020-08-18 07:04:24.174 XYZ jacksparrow 0.0000000940635800 IMPORTANT: The index of all of these is "_internal", not the actual index that the source data comes from. Search 2: | tstats count where (index=BlackPearl OR index=Tortuga OR index=Swashbuckler) by index, sourcetype | table sourcetype, index Results: (example - roughly 86 rows returned) sourcetype index ship BlackPearl crew BlackPearl rum Tortuga wench Tortuga willturner Swachbuckler jacksparrow Swashbuckler I want to join these results to make a single table of: _time _raw sourcetype index GB 2020-08-18 07:04:33.307 ABC ship BlackPearl 0.0000264551490559 2020-08-18 07:04:31.168 LMN rum Tortuga 0.0000000828877091 2020-08-18 07:04:24.174 XYZ jacksparrow Swachbuckler 0.0000000940635800 I tried to use append and it just adds the additional sourcetype/index rows below the actual results (not as a new column). I tried to use appendcols and the number of rows between the first search and the second search don't match, so only the first handful of rows get an index and the index doesn't match up with the sourcetype. I tried to use join with the max=0 and type=inner and it only returned a handful of rows (less than 1000) and only for a few of the index/sourcetype combinations. I even just tried to use the second search as a subsearch of the first search to limit the sourcetypes to ONLY the ones returned in the tstats search... which I think worked, but still didn't tell me which index applied to each sourcetype. I can run the two separately, extract the data into excel and do a vlookup to get the results I want, but I need this to be in the report/search. Help me! I'm drowning. Be gentle, this is my first discussion topic. Hope this is enough information to clearly understand the problem.