I have two searches, one that gives me a table:
The second from another index gives me a table of volume and used space:
I need to combine these two for a single table. The second search needs to use the value of parent_volume in the first search so volume=parent_volume to get the space_used.
I have tried various subsearches with appendcols, but nothing has given me my results. I can't seem to get the second search to use volume={the value of parent_volume} in the search.
This gave me the details I was looking for:
index="netapp_snapmirror_reports" source="/var/tmp/netapp_snapmirror/splunk_flexclone_detail.csv"
|rename parent_volume as volume
| join volume [search index="netapp_snapmirror_reports" source="/var/tmp/netapp_snapmirror/splunk_volume_detail.csv"]
|table vserver flexclone flexclone_used_percent volume percent_used parent_snapshot
|rename volume as "parent_volume"
This gave me the details I was looking for:
index="netapp_snapmirror_reports" source="/var/tmp/netapp_snapmirror/splunk_flexclone_detail.csv"
|rename parent_volume as volume
| join volume [search index="netapp_snapmirror_reports" source="/var/tmp/netapp_snapmirror/splunk_volume_detail.csv"]
|table vserver flexclone flexclone_used_percent volume percent_used parent_snapshot
|rename volume as "parent_volume"
@jfraley can you try the following stats
index="netapp_snapmirror_reports" AND (source="/var/tmp/netapp_snapmirror/splunk_flexclone_detail.csv") OR (source="/var/tmp/netapp_snapmirror/splunk_volume_detail.csv" volume=*)
| eval mergedVolume=if(match(source,"splunk_flexclone_detail.csv"),parent_volume,volume)
| stats last(vserver) as vserver,last(flexclone) as flexclone,last(flexclone_used_percent) as flexclone_used_percent,last(parent_snapshot) as parent_snapshot last(space_used) as space_used by mergedVolume
@jfraley Did you try using join?
Well, I had tried, but did not get my results. I just tried join again and was able to get what I needed. Here is what I have:
Thanks