Splunk Search

join search with condition

arandy01
Explorer

I have two searches:
search-A gives values like
 

typestatushostnameidportSizebasecache
httpOFFhost-117NANANANA
httpONhost-16NANANANA
httpONhost-115NANANANA
httpOFFhost-11NANANANA
webOFFhost-217NANANANA
webONhost-26NANANANA
httpONhost-315NANANANA
httpOFFhost-31NANANANA

 

Search-B gives value like

typestatushostnameidportSizebasecache
availablenot_processedhost-117NANANANA
availablenot_processedhost-217NANANANA
availablenot_processedhost-415NANANANA
availablenot_processedhost-51NANANANA

 

I want to merge two search in such a way that it can check hostname in search-B and if hostname is present in search-A the it should not join/merge that row.. the result should be something like below...

typestatushostnameidportSizebasecache
httpOFFhost-117NANANANA
httpONhost-16NANANANA
httpONhost-115NANANANA
httpOFFhost-11NANANANA
webOFFhost-217NANANANA
webONhost-26NANANANA
httpONhost-315NANANANA
httpOFFhost-31NANANANA
availablenot_processedhost-415NANANANA
availablenot_processedhost-51NANANANA




Labels (4)
0 Karma
1 Solution

manjunathmeti
Champion

hi @arandy01,
Try this:

 

search-A | append [search search-B] | eventstats count(eval(status IN("ON", "OFF"))) as status_count by hostname | where NOT (status_count!=0 AND status="not_processed")

 

View solution in original post

manjunathmeti
Champion

hi @arandy01,
Try this:

 

search-A | append [search search-B] | eventstats count(eval(status IN("ON", "OFF"))) as status_count by hostname | where NOT (status_count!=0 AND status="not_processed")

 

View solution in original post

arandy01
Explorer

Hi @manjunathmeti 
Thanks for the quick reply...
But it does not work... and only shows results from search-A

0 Karma

manjunathmeti
Champion

Updated my answer check now.

arandy01
Explorer

Thanks a lot 🙂
works perfectly 🙂

0 Karma