I have 2 Splunk SPLs
=====================
index=computer_admin source=admin_priv sourcetype=prive:db account_name=admin earliest=-1d
| fields comp_name,comp_role,account_name,local_gp,gp_name
| table comp_name,comp_role,account_name,local_gp,gp_name
=====================
The comp_name fields has values such as ,
AAAAA, BBBBB, CCCCC, AFSGSH, GFDFDF, IUYTE, HGFDJ, ZZZZZ, YYYYYY, IIIIII, EEEEEE
Basically I am looking for all the comp_names that the admin is on and copying the list to use in another SPL to get the comp owners.
Second SPL :
===================
index=computer_admin source=emp_card_details sourcetype="something:db" C_NAME IN (AAAAA, BBBBB, CCCCC, AFSGSH, GFDFDF, IUYTE, HGFDJ, ZZZZZ, YYYYYY, IIIIII, EEEEEE)
| eval arl=lower(C_NAME)
| stats values(asset_owner) by arl
===================
Can we use subsearch or any thing similar to get it done in on SPL ?
Any assistance ?
Hi @zacksoft_wf
can you try this
index=computer_admin source=emp_card_details sourcetype="something:db"
| join type=left C_NAME
[| search index=computer_admin source=admin_priv sourcetype=prive:db account_name=admin earliest=-1d
| rename comp_name as C_NAME
| table C_NAME,comp_role,account_name,local_gp,gp_name]
| eval arl=lower(C_NAME)
| stats values(asset_owner) by arl
Hi @zacksoft_wf
can you try this
index=computer_admin source=emp_card_details sourcetype="something:db"
| join type=left C_NAME
[| search index=computer_admin source=admin_priv sourcetype=prive:db account_name=admin earliest=-1d
| rename comp_name as C_NAME
| table C_NAME,comp_role,account_name,local_gp,gp_name]
| eval arl=lower(C_NAME)
| stats values(asset_owner) by arl
@SanjayReddy The field name is C_NAME in one SPL and comp_name is another SPL,
In that case will, | join type=left C_NAME truly join the two data sets ?
Just curious, my understanding could be wrong here !
Hi @zacksoft_wf
in sub search we are renaming comp_name as C_NAME to match with data in main query
then both sub search and main searches are joined by common field C_NAME
@SanjayReddy Thanks Sanjay, this helps.
About the earliest=-1d written in the inner SPL, does it mean , it will force both the inner and outer query to run in the -1d time range , irrespective of the time range chosen in the search-bar ?
Hi @zacksoft_wf
earliest=-1d only applicable to inner search
main search will run on time frame that selected in time range picker
if you want to run both searches on same time frame you can remove earliest=-1d from inner search
then both searche will run as per time rangepicker time
---
If this reply helps you, an upvote/Karma would be appreciated.