Splunk Search

Search with two "join"

MaximeM
Explorer

Hi everyone !
I try to get some values from different searches using "join".
Here is my search command :

 host="yvas7300" sourcetype="accesslog" type_op="srch" conn="22" op="5" timestamp="27/Sep/2012:01:33:57" | eval tm=timestamp
| join host [search sourcetype="errorslog" type="started" timestamp<=tm | sort -timestamp | head 1 | eval tmstarted=timestamp | fields host tmstarted]
| join host conn [search sourcetype="accesslog" type_op="bind" timestamp>=tmstarted timestamp<=tm | fields host conn dn]

First, i get a specific event and I save its time (tm), then I get the time when my server is starting (tmstarted), and finally I want to get some values from an event of type "bind" with the same connection number of the first event, between tmstarted and tm.

But it seems that the last join can't access to "tmstarted". When I replace "tmstarted" by its value (for example : timestamp>="27/Sep/2012:00:00:00"), the command works correctly, but I got nothing when I do "timestamp>=tmstarted".

Can someone help me please ?

0 Karma

yannK
Splunk Employee
Splunk Employee

Each search populating a JOIN is like a subsearch, it run's separately from the other searches.
So the field tm created in the main search is not present in the first JOIN.
and the field tmstarted created in the first JOIN is not present in the second JOIN.

I don't see how to achieve what you want to do using JOIN.
you could use a transaction instead, or multiple searches with passing time conditions, see
http://splunk-base.splunk.com/answers/9940/search-for-events-that-happened-around-the-time-of-other-...

Ayn
Legend

Subsearches run on their own, so I highly doubt you're able to access a field you've created in an outer search, unless that field existed before that in some other form.

0 Karma

MaximeM
Explorer

Thanks for your answer.
Actually, I can access to the field "tm" in both JOINs. And if I correctly understood the transaction command, I can't use it on events with different sourcetypes.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...