Can the results of a primary search be reused (without recomputing the primary search) in multiple joins with different secondary searches that go to separate panels in a dashboard? Something like | join [ ] in dashboard panel 2, | join [ ] in dashboard panel 3, | join [ ] in dashboard panel 4, etc? Thanks. ... View more

I want to compute a join of an extracted, multi-value SourceTypeA:field_a string variable with an extracted SourceTypeB:field_b string variable. I've received a partial answer on how to do a "detour join" in Splunk via Intersect and Stats: (sourcetype="SourceTypeA" ...) OR (sourcetype="SourceTypeB" ...) | eval c = if (sourcetype=="SourceTypeA", SourceTypeA:field_a, SourceTypeB:field_b) | stats values (x) values (y) values(z) by c I'm guessing the searches (for the extracted, multi-value field_a and extracted field_b) go in the sourcetype clauses above. I want to output the values where SourceTypeA:field_a = SourceTypeB:field_b. Thanks for your help. ... View more

In Splunk 4.3 I want to do a join of an regex-extracted variable A (belonging to app/sourcetype a) with a variable B (belonging to app/sourcetype b). I've tried several variations of something like this: sourcetype="a" < ... extracted search for variable A ...> | rename A as C | join C [ | rename sourcetypeb:B as C ] but can't quite get the right answer (an inner join). Note the use of the qualifier soucetypeb:B to define the subsearch variable B. At least Splunk isn't complaining about a syntax error, so I think I'm on the right track. (The subsearch hasn't run up against the 60-second limit.) Thanks for any help you can offer. ... View more