Hi,
Why we are not able to join my search? Can you please suggest how to edit this?
index=idx* sourcetype=Uptime host="*bd*" SystemUpTime>300
| eval difference=(_time - SystemUpTime)
| eval c_time=strftime(difference,"%Y-%m-%d %H:%M:%S")
|join host [search index=idx2_* sourcetype=ps1 |dedup host ]|table host c_time cluster
Try selfjoin
index=idx* sourcetype=Uptime host="*bd*" SystemUpTime>300
| eval difference=(_time - SystemUpTime)
| eval c_time=strftime(difference,"%Y-%m-%d %H:%M:%S")
|selfjoin host [search index=idx2_* sourcetype=ps1 |dedup host ]|table host c_time cluster
Is there any other we can join this, join taking long time to give results.?
I would recommed a two-part search.
1) Create a lookup table OR kvstore, with only the hosts from your subsearch. Like this
index=idx2_* sourcetype=ps1 |dedup host | table host cluster | outputlookup hostlist.csv
You can schedule this to run at a certain frequency (how often do you add new hosts). You can the use this lookup to append cluster info, like this. You could also add the cluster info as an automatic lookup
index=idx* sourcetype=Uptime host="*bd*" SystemUpTime>300
| eval difference=(_time - SystemUpTime)
| eval c_time=strftime(difference,"%Y-%m-%d %H:%M:%S")
| lookup hostlist.csv host OUTPUT cluster
| table host cluster
http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Outputlookup
http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Lookup