Splunk Search

Problems with search and join command

mlevenson
Explorer

I am trying to run a search that show's both bytes_in and bytes_rec for the network card. Here is my search -

source="Perfmon:Network Interface" host=stbackup06 counter="Bytes Sent/sec"|stats avg(Value) AS Bytes_in by host|join host[source="Perfmon:Network Interface" host=stbackup06 counter="Bytes Recieved/sec"|stats avg(Value) AS Bytes_Rec by host]|timechart avg(Bytes_in) avg(Bytes_Rec)

The error I get is Search operation 'source' is unknown. You might not have permission to run this operation.

Tags (3)
0 Karma
1 Solution

Ayn
Legend

In subsearches, unlike in the "main" search pipeline, you need to explicitly state the command that should run at the start, which means you need to start off with "search", so for instance [search source ...

So, this should work (at least the subsearch should, I haven't looked deep into your join operation tbh):

source="Perfmon:Network Interface" host=stbackup06 counter="Bytes Sent/sec"|stats avg(Value) AS Bytes_in by host|join host [search source="Perfmon:Network Interface" host=stbackup06 counter="Bytes Recieved/sec"|stats avg(Value) AS Bytes_Rec by host]|timechart avg(Bytes_in) avg(Bytes_Rec)

View solution in original post

cramasta
Builder

you need to start the subsearch with "search" like below

source="Perfmon:Network Interface" host=stbackup06 counter="Bytes Sent/sec"|stats avg(Value) AS Bytes_in by host|join host[search source="Perfmon:Network Interface" host=stbackup06 counter="Bytes Recieved/sec"|stats avg(Value) AS Bytes_Rec by host]|timechart avg(Bytes_in) avg(Bytes_Rec)

0 Karma

cphair
Builder

You need to put the word "search" explicitly in your subsearch: [search source=...

You could also try counter="Bytes Sent/sec" OR counter="Bytes Received/sec" and cut out the subsearch entirely. Might need to fiddle with the rest of the command some.

0 Karma

Ayn
Legend

In subsearches, unlike in the "main" search pipeline, you need to explicitly state the command that should run at the start, which means you need to start off with "search", so for instance [search source ...

So, this should work (at least the subsearch should, I haven't looked deep into your join operation tbh):

source="Perfmon:Network Interface" host=stbackup06 counter="Bytes Sent/sec"|stats avg(Value) AS Bytes_in by host|join host [search source="Perfmon:Network Interface" host=stbackup06 counter="Bytes Recieved/sec"|stats avg(Value) AS Bytes_Rec by host]|timechart avg(Bytes_in) avg(Bytes_Rec)
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...