Splunk Search

How do I join on a specific field?

slatta
Explorer

I have many events, but only want to select those that have the same docId in order to compare the Durations of 2 different viewers.

Sample Data:

Viewer=viewer1, docId=12345, Duration=1204
Viewer=viewer2, docId=12345, Duration=998
Viewer=viewer1, docId=42543, Duration=1411
Viewer=viewer1, docId=98322, Duration=1502
Viewer=viewer2, docId=77777, Duration=1256
....

Expected Output (only get docId, durations that has been viewed by both viewer1 and viewer2, e.g. docId=12345):

docId, Viewer1_Duration, Viewer2_Duration
12345, 1204, 998

Tags (1)
0 Karma

aholzer
Motivator

To join the data, you just need to use a join

<base search> Viewer=viewer1 | join docId [search <base search> Viewer=viewer2]

This should get you the join. If you want the two durations distinguished though, you should rename the duration fields to something else before the join

<base search> Viewer=viewer1 | rename Duration AS Viewer1_Duration | join docId [search <base search> Viewer=viewer2 | rename Duration AS Viewer2_Duration ]

Hope this helps

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...