On my spunk dashboard I am showing tables with two different sources. Is there a way to have the tables sync up with the different data?
For example: If I have a License Key that appears in one table that matches the License Key (from a different source) in the other table, can it show the Documents Processed from this?
Do I need to create a search to merge these sources together or can I just do it through the dashboard?
Thanks in advance.
Yes, you must write an SPL query to combine the two searches. The dashboard will not do it for you.
Like @kiamco suggests, you can use join
to combine them, but that is usually the least efficient way. Often, stats
can used instead of join
. See http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Join
Yes, you must write an SPL query to combine the two searches. The dashboard will not do it for you.
Like @kiamco suggests, you can use join
to combine them, but that is usually the least efficient way. Often, stats
can used instead of join
. See http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Join
I have tried using a join and this is what I came up:
source="C:\Users\ragate\Desktop\splunk\LMCustomerRevLicense.csv" | join type=left substr('context.custom.dimensions{}.LicenseKey' ,4,7) [search source="c:\users\ragate\desktop\splunk\jsondump.txt"] | eval LicenseKeyID=substr('context.custom.dimensions{}.LicenseKey' ,4,7) | where 'LicenseKeyID'='License Key Identifier'
This only brings but one event in each field when there should be about 20 more there. Not sure where I went wrong. Also have been told that stats would work but I am not sure how to use that to do what I want.
The first argument to join
after type=left
should be a field name, not an expression.
source="C:\\Users\\ragate\\Desktop\\splunk\\LMCustomerRevLicense.csv" | eval LicenseKeyID=substr('context.custom.dimensions{}.LicenseKey' ,4,7) | join type=left LicenseKeyID [search source="c:\\users\\ragate\\desktop\\splunk\\jsondump.txt" | eval LicenseKeyID=substr('context.custom.dimensions{}.LicenseKey' ,4,7)]
Thank you!
Try using the join command
eg:
your first search..
|join "License key" [|search second search]