I am trying to join two searches together to table the combined results by host.
First search below is showing number of events in the last hour by host, index, and sourcetype:
| tstats count w...
this is the query, so i'm still a baby in this world (so I'm sorry if there is a dummy mistakes that might drive you crazy when you read this query). However, I'm trying to Join the Source Process I...
Hello, How to join data from index and dbxquery without using JOIN, APPEND or stats command? Issue with JOIN: limit of subsearch 50,000 rows or fewer. Missing data. Issue with A...
...ename id as sessionID
| fields apiName, payload, sessionID
WAF search:
index=waf
| fields src_ip, requestHost, requestPath, requestUserAgent, sessionID
My attempt to join them on the s...
Hi Splunkers,
I struggled badly trying to get this solved, but no luck?
I need to join to a different search using the ip_address to get the host name :
Base search for the join: index= X&n...
...699808594.000000 CD /MEDIA 14 192.168.200.55 1699808587.000000 cd /medi 15 192.168.200.55 1699808584.000000 omar when i try to join the two by running: index=main source="/media/ssd1/i...
Anything wrong with this join and subsearch? I know there are events which should match based on the 'cs_host' field. Not sure if the rename is confusing things, or my syntax is off slightly.
i...
I am noob with Splunk. I am trying to join two indexes in one search - index="idx-enterprise-tools" sourcetype="spectrum:alarm:json"
| eval Host=substr(host,1,9) Second Index - index=i...