Splunk Search

join search with condition

arandy01
Explorer

I have two searches:
search-A gives values like
 

typestatushostnameidportSizebasecache
httpOFFhost-117NANANANA
httpONhost-16NANANANA
httpONhost-115NANANANA
httpOFFhost-11NANANANA
webOFFhost-217NANANANA
webONhost-26NANANANA
httpONhost-315NANANANA
httpOFFhost-31NANANANA

 

Search-B gives value like

typestatushostnameidportSizebasecache
availablenot_processedhost-117NANANANA
availablenot_processedhost-217NANANANA
availablenot_processedhost-415NANANANA
availablenot_processedhost-51NANANANA

 

I want to merge two search in such a way that it can check hostname in search-B and if hostname is present in search-A the it should not join/merge that row.. the result should be something like below...

typestatushostnameidportSizebasecache
httpOFFhost-117NANANANA
httpONhost-16NANANANA
httpONhost-115NANANANA
httpOFFhost-11NANANANA
webOFFhost-217NANANANA
webONhost-26NANANANA
httpONhost-315NANANANA
httpOFFhost-31NANANANA
availablenot_processedhost-415NANANANA
availablenot_processedhost-51NANANANA




Labels (4)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @arandy01,
Try this:

 

search-A | append [search search-B] | eventstats count(eval(status IN("ON", "OFF"))) as status_count by hostname | where NOT (status_count!=0 AND status="not_processed")

 

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

hi @arandy01,
Try this:

 

search-A | append [search search-B] | eventstats count(eval(status IN("ON", "OFF"))) as status_count by hostname | where NOT (status_count!=0 AND status="not_processed")

 

arandy01
Explorer

Hi @manjunathmeti 
Thanks for the quick reply...
But it does not work... and only shows results from search-A

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Updated my answer check now.

arandy01
Explorer

Thanks a lot 🙂
works perfectly 🙂

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...