Splunk Search

JOIN how to save as an eventtype ?

jermi001
Engager

Hello Splunkers,

I'm using JOIN expression to classify a type of errors. I want to have all errors classified like an eventtype to make searches, charts easier to future users.

For example 2 events:
1.First event has got the name(for example=xError) of process and its ID_Number (for example = 999).
2.Second event has got an information about exception -> "Caught exception" and same ID_Number = 999.

Edit: I want to have second event marked as eventtype=xError.

My search:
index="test" Caught exception | JOIN ID_Number [searches index="test" xError]

How it export to eventtype or something else ? Message: Eventtype search string cannot be a search pipeline or contain a subsearch

I would like to have these results have in event type or as "intresting field". It is possible to do that? How ???

I would be grateful for help!!!

Regards

0 Karma

jermi001
Engager

Hello,

thank you for help, another question is, can I make a count chart by macros ? I mean I have for example many macros and I want to create a chart with numbers, how many logs was occurred in each macro

Regards 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi jermi001,
at first I suggest to use (if possible) stats command instead join because join is very slow, something like this:

index="test" Caught exception 
| stats values(process) AS process values(information) AS information BY ID_Number

Anyway answering to your question, you cannot create an eventtype because there is one pipe, but as usefule workaround, you could create a macro containing your full search that you could use like an eventtype.
Obviously in this way you haven't all the fields of your index but only the ones that you put as values in your stats command.

Bye.
Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...