Splunk Search

Need clarification for the 3 options of the join command

email2vamsi
Explorer

Could you please explain the following three options of join?

I could not understand them.

usetime
Syntax: usetime=<bool>
Description: A Boolean value that Indicates whether to use time to limit the matches in the subsearch results. Used with the earlier option to limit the subsearch results to matches that are earlier or later than the main search results.
Default: true

earlier
Syntax: earlier=<bool>
Description: If usetime=true and earlier=true, the main search results are matched only against earlier results from the subsearch. If earlier=false, the main search results are matched only against later results from the subsearch. Results that occur at the same time (second) are not eliminated by either value.
Default: true

overwrite
Syntax: overwrite=<bool>
Description: Indicates whether fields from the subresults overwrite the fields from the main results, if the fields have the same field name.
Default: true
Tags (2)
0 Karma

woodcock
Esteemed Legend

BTW, there is almost always a better way to do what you need to do than using join. Go here and look at the March 2016 session:
https://wiki.splunk.com/Virtual_.conf

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi email2vamsi,
the first two are to be used together to limit results (when they are both true) of the main search: they are matched only against earlier results from the subsearch.
About the third: if you have the same field name in both the searches but different values, in your results you'll have only the main search values, values of second search are overwritten an not showed.

Bye.
Giuseppe

0 Karma

email2vamsi
Explorer

In join how many sub-queries can be run?
If yes,the syntax remains the same?

Can the following be done?
index="index2" sourcetype="sql-production-response" | join running_ok
  [search index="index2" sourcetype="sql-production-monitor" ]  | join running_ok
  [search index="index2" sourcetype="sql-production-action" ]
0 Karma

gcusello
SplunkTrust
SplunkTrust

I didn't try more levels of sub-queries (only two levels of sub-queries), but I don't think that there is a real limit, the only one is probably the time execution because you overload your search.
About the syntax, I think that it's always the same, but options are relative only to the search in which you inserted options and the first sub-query, I don't think that it's recursive.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...