Splunk Search

Join with condition OR

gibba
Path Finder

Hi Everyone

i need to use a splunk join,

i want ask is possible use two field with OR condition

Example

my search | fields column 1, column 2, column 3 | join cloumn 1 OR column 2 [ my second search]

thank you
For your time

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Skip join entirely (it has inescapable limits) and do this

my saearch OR my second search | eval joiner=coalesce(column1, column2) | stats values(*) AS* BY joiner | fields - joiner

Just try it before you think it won't work.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Skip join entirely (it has inescapable limits) and do this

my saearch OR my second search | eval joiner=coalesce(column1, column2) | stats values(*) AS* BY joiner | fields - joiner

Just try it before you think it won't work.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi gibba,
no you cannot use an OR condition in a join.
What's the problem values in column1 and column2?
if this is the problem you could use an eval with coalesce function

my search 
| eval column=coalesce(column1,column2) 
| join column [ my second search]

Bye.
Giuseppe

0 Karma

gibba
Path Finder

Ciao Giuseppe

i try to use olny one column beacause the second sometimes is null but i can't use coalesce beacuase i need column 2= null

thank for your time

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...