About mattiasrs

mattiasrs · ‎02-26-2021

Hi Giuseppe and thanks for your reply! I tried your solution but it seems like it is searching through everything from Index B, which is not an option here due to the amount of data in that index. Also, maybe worth mentioning is that the pid field in index B contains data that is not present in Index A so I need it to only consider the top 10 count from Index A. Any idea what I'm doing wrong?

mattiasrs · ‎02-26-2021

Hello awesome community! I got help from here once before so I will try again. I have two indexes, Index A and Index B. Fields: Index A: id Index B: pid, address I want to retrieve the top 10 count ids from Index A and then join these 10 with Index B to retrieve the address info. This is my search (simplified) to retrieve the top 10 ids from Index A: index = A | stats count by id | sort -count | head 10 Index B is huge so I only want to search it for the top 10 ids found from Index A search above. How can I use the results found from the above search into a search from Index B? Many thanks

mattiasrs · ‎02-08-2021

Many thanks!

mattiasrs · ‎02-08-2021

Thank you! With this I am able to achieve what I want. Do you know if this is best practice?

mattiasrs · ‎02-08-2021

Hello, No this returns only the raw events, not in a table format. I tried moving |table outside the [ ] but this returns data that exist in both indexes, just not showing the data from index B.

mattiasrs · ‎02-05-2021

Hello, I am quite new to Splunk and this is my first post. Hoping that I can get some help from this awesome community. I have two systems, System A and System B. System A receives customer information which is then sent to System B . The data in both systems have the exact same fields and a unique Customer ID with the same name in both systems. I want to create a dashboard where I can select a time period and see only problematic customers that only exist in System A, meaning they haven't been sent to System B for some reason. This is my search to see all the data: index=systemA OR index=systemB | fields customer_ID, systemA_Timestamp, systemB_Timestamp | stats values(*) as * by customer_ID | table customer_ID, systemA_Timestamp, systemB_Timestamp So to summarize, I want to see customer_IDs that only exist in System A. I am not sure which function to use here. I have been experimenting with isnull(systemB_Timestamp) with no success. Join is not an option as the limit of 50 000 might be a problem. Would be very grateful for any help!

Posts	6
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎02-05-2021

Online Status	Offline
Date Last Visited	‎02-26-2021 11:03 AM

Limited search join

Left join - find missing data from second index

Re: Limited search join

Limited search join

Re: Left join - find missing data from second inde...

Re: Left join - find missing data from second inde...

Re: Left join - find missing data from second inde...

Left join - find missing data from second index

Join the Conversation