Why am I not able to join my search?

[splunker9999]

Hi,

Why we are not able to join my search? Can you please suggest how to edit this?

index=idx* sourcetype=Uptime host="*bd*" SystemUpTime>300
| eval difference=(_time - SystemUpTime)
| eval c_time=strftime(difference,"%Y-%m-%d %H:%M:%S")
|join host [search index=idx2_* sourcetype=ps1 |dedup host ]|table host c_time cluster

[sundareshr]

Try selfjoin

index=idx* sourcetype=Uptime host="*bd*" SystemUpTime>300
 | eval difference=(_time - SystemUpTime)
 | eval c_time=strftime(difference,"%Y-%m-%d %H:%M:%S")
 |selfjoin host [search index=idx2_* sourcetype=ps1 |dedup host ]|table host c_time cluster

[splunker9999]

Is there any other we can join this, join taking long time to give results.?

[sundareshr]

I would recommed a two-part search.

1) Create a lookup table OR kvstore, with only the hosts from your subsearch. Like this

index=idx2_* sourcetype=ps1 |dedup host | table host cluster | outputlookup hostlist.csv 

You can schedule this to run at a certain frequency (how often do you add new hosts). You can the use this lookup to append cluster info, like this. You could also add the cluster info as an automatic lookup

index=idx* sourcetype=Uptime host="*bd*" SystemUpTime>300
  | eval difference=(_time - SystemUpTime)
  | eval c_time=strftime(difference,"%Y-%m-%d %H:%M:%S")
  | lookup hostlist.csv host OUTPUT cluster 
  | table host cluster

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Outputlookup
http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Lookup