Splunk Search

JOIN how to save as an eventtype ?

jermi001
Engager

Hello Splunkers,

I'm using JOIN expression to classify a type of errors. I want to have all errors classified like an eventtype to make searches, charts easier to future users.

For example 2 events:
1.First event has got the name(for example=xError) of process and its ID_Number (for example = 999).
2.Second event has got an information about exception -> "Caught exception" and same ID_Number = 999.

Edit: I want to have second event marked as eventtype=xError.

My search:
index="test" Caught exception | JOIN ID_Number [searches index="test" xError]

How it export to eventtype or something else ? Message: Eventtype search string cannot be a search pipeline or contain a subsearch

I would like to have these results have in event type or as "intresting field". It is possible to do that? How ???

I would be grateful for help!!!

Regards

0 Karma

jermi001
Engager

Hello,

thank you for help, another question is, can I make a count chart by macros ? I mean I have for example many macros and I want to create a chart with numbers, how many logs was occurred in each macro

Regards 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi jermi001,
at first I suggest to use (if possible) stats command instead join because join is very slow, something like this:

index="test" Caught exception 
| stats values(process) AS process values(information) AS information BY ID_Number

Anyway answering to your question, you cannot create an eventtype because there is one pipe, but as usefule workaround, you could create a macro containing your full search that you could use like an eventtype.
Obviously in this way you haven't all the fields of your index but only the ones that you put as values in your stats command.

Bye.
Giuseppe

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...