All Apps and Add-ons

How to join or lookup results from one search to another for table output?

GeorgeStarkey
Path Finder

in the vmware app the following pieces exist

index=vmware-perf
moid mem_used mem_committed

index=vmware-inv
moid changeSet.name

changeset.name is the actual hostame of the vm's so endusers can easily identify.

I want to run something like this:
index=vmware-perf sourcetype=vmware:perf:mem moid=vm* | eval overuse=mem_committed-mem_used | stats min(overuse) by moid,mem_committed,mem_used | dedup moid

HOWEVER I then want to join (or lookup/remap) the changeSet.name from the other index based on the moid so that I can end up with a table that shows:

changeSet.name moid mem_committed mem_used overuse
host1 vm-5619 65222 32001.238281 33220.761719
host2 vm-822 65138 35497.636719 29640.363281
etc..

This is probably a simple join, but I can't quite get it to function

1 Solution

GeorgeStarkey
Path Finder

I have solved this myself with:

index=vmware-perf
sourcetype=vmware:perf:mem moid=vm*
mem_committed>1 | join moid [search
index=vmware-inv moid=*
changeSet.name=vm*] | eval
overuse=mem_committed-mem_used | stats
min(overuse) by
changeSet.name,moid,mem_committed,mem_used
| dedup moid

though this is still very slow. there must be a faster way.

View solution in original post

GeorgeStarkey
Path Finder

I have solved this myself with:

index=vmware-perf
sourcetype=vmware:perf:mem moid=vm*
mem_committed>1 | join moid [search
index=vmware-inv moid=*
changeSet.name=vm*] | eval
overuse=mem_committed-mem_used | stats
min(overuse) by
changeSet.name,moid,mem_committed,mem_used
| dedup moid

though this is still very slow. there must be a faster way.

mipeters_splunk
Splunk Employee
Splunk Employee

the faster way would be to use data models and use the |tstats command with summariesonly. Good luck !!!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...