Splunk join only returns first match full#
I tried doing for example | eval l_time=max(l_time), but it doesn't affect the full row. I wanted to return just the line with the max l_time, so that the table would be : IP c s sev l_time I've tried using the 'search' command and 'foreach' command, but have had no joy. | lookup ip_lookup_table ipaddr as ip outputnew confidence as c source as s severity as sev _time as l_timeįor example, this will return a table with: IP c s sev l_timeġ0.0.0.1. Run the event log query for users that exist in the array, e.g.: using semantics such as isin () or contains () or ii) Enumerate the group members and perform a foreach () type loop. Here's my example: index=index_a ip=10.0.0.1 I want to return just 1 match, depending on a criteria, for example the highest number or such. However, the lookup returns more than 1 result for each match.
.jpg "splunk join only returns first match")
It is still limited by the maximum size of the subsearch, but at least provides the necessary data.I'm enriching my search with a match against a lookup table. This is faster than using a map with multiple subsearches, and gives all the of results. | eval zipped=mvzip(mvzip(first2, last2, ","), date, ",") | search first1!=null last1!=null first2!=null last2!=null | stats list(first1) as first1, list(last1) as last1, list(first2) as first2, list(last2) as last2, list(date) as date by matchId | rename referrer_id as matchId, first_name as first2, last_name as last2 | rename id as matchId, first_name as first1, last_name as last1 Splunk doesn't offer a multifield mv expand, so I used a workaround. It also gave extra empty fields, so I had to remove those, and then manipulate the resulting mv's into their own individual rows. Using append returned a full list, and using stats by id gave me the result I was looking for, a full list of each matching pair. Using join gave me faster results, but didn't result in every matching pair, for my example it would return 2 rows instead of three, returning Adam with Betty, but not returning Adam with Carol. Surely there must exist a simpler, faster way that this can be done, which isn't limited by the arbitrary limited settings or the multiple repeating search queries. This seems like an overly complicated solution, especially in comparison to the sql query. The above query works for me and gives me the table I need, but it is incredibly slow due to the repeated searches over the entire time frame, and also limited by the map maxsearches which, for whatever reason, cannot be set to unlimited. Values(last2) as last2, values(time) as time by id | stats values(first1) as first1, values(last1) as last1, values(first2) as first2, | fields first1, last1, first2, last2, match_id, time | fields first_name, last_name, referral_id, date I did attempt to use appendcols but that didn't return anything for me. Then, since append creates a new row instead of appending to the same row, using a stats to aggregate the resulting rows by the matching id field. Next, I attempted to use a subsearch, first finding the id and then searching in the subsearch, first for the first event by id and the appending the second event by referral_id. First I attempted to use the transaction command, but that aggregated all of the related events together as opposed to matching them a pair at a time. Now, I've been attempting to replicate this in a splunk query and have run into quite a few issues. OUTPUT: looking to execute above red highlighted search query on events whose 'time' field value is equal to or greater than field value 'wmsentDateTime' which we got from search query highlighted in green. Inner join myTable b on a.id = b.referrer_id select a.first_name as first1, a.last_name as last1, b.first_name as first2, In sql I can do this quite easily with the following command.
Adam Anderson referred Betty Burger on 08:00:00.000.An index of -1 is used to specify the last value in the list.
Both the
When the I have a data source in which I need to return all pairs of events (event1, event2) from a single data source, where field1 from event1 matches field2 from event2.įor example, let's say I have the following data.
0 kommentar(er)
