Splunk Enterprise

Is it possible to join two joint queries

kirrusk
Communicator

Hi All,

 

In Splunk is it possible to join two joint queries.

 

I have queries like 

1)

index=_inter sourcetype=project 
| dedup project  server
|  eval Pro=project
| eval source1 ="Y" 
| table source1 Pro | join Pro type=outer
| [search sourcetype =SA  pronames=* |  dedup  pronames | eval Pro=pronames  ] 
| table Pro 

which will generate output

pro

pro1
pro2
pro3

@and I have one query similar one , but changing sourcetype in join .

,index=_inter sourcetype=project 
| dedup project  server
|  eval Pro=project
| eval source1 ="Y" 
| table source1 Pro | join Pro type=outer
| [search sourcetype =SC  pronames=* |  dedup  pronames | eval Pro=pronames  ] 
| table Pro

pro

pro1
pro2
pro3

Both I'm using for generating alerts, two alerts.

now I want to send only one alert by merging both queries,  is it possible.

so i can send alerts in a single mail. like below

 

pro       pros
pro1   pro1
pro2   pro2
pro3   pro3

 

 

 

 

 

 

 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is it you are trying to do here?

The first search will return a list of projects from the first part of the search and since it is an outer join and you are only keeping the project name, join is basically redundant

The same thing applies to the second search.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...