- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Why does a join of a search and subsearch on _time...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A join on _time can fail even if the epoch values match. The failure is caused if one epoch _time value has a numeric format with decimal places and the other does not.
Example:
If on left side, you have _time=1405206000
and on right side, you have _time=1405206000.000
the join will fail, even if on screen you will see the same value on both sides: 2014-07-13 00:00:00
If you first timestamp is always precise to the second and no more, here is how you can make your join safer:
eval _time=round(_time,0) on the right side.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just edited the entire post to fit the Q&A format 🙂 Thanks for posting @manus. I think others will find this content useful
Patrick
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well yes, initially, I wanted to ask about my problem on joining on time... but then I figured it out, so I thought I would share the reply, even though I don't have a question anymore
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A join on _time can fail even if the epoch values match. The failure is caused if one epoch _time value has a numeric format with decimal places and the other does not.
Example:
If on left side, you have _time=1405206000
and on right side, you have _time=1405206000.000
the join will fail, even if on screen you will see the same value on both sides: 2014-07-13 00:00:00
If you first timestamp is always precise to the second and no more, here is how you can make your join safer:
eval _time=round(_time,0) on the right side.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you have a question?
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
