#Splunk join software#

See Descriptions for the join-options argument in this topic. Use either outer or left to specify a left outer join.

#Splunk join software#

When is used in a search by itself with no join keys, the Splunk software autodetects common fields and combines the search results before the join command with the results of the subsearch. You can use either : or in a search, but not both. The results of the subsearch should not exceed available memory. The subsearch must be enclosed in square brackets. subsearch Syntax: Description: A secondary search or dataset that specifies the source of the events that you want to join to.

You can use either : or with the join command, but not both. For example, if the dataset name is january and the dataset type is datamodel, you specify datamodel:january. The dataset name must follow the dataset type. The dataset must be a dataset that you created or are authorized to use. dataset-name Syntax: Description: The name of the dataset that you want to use to join with the source data. The dataset type must precede the dataset name. You can specify datamodel, savedsearch, or inputlookup. : | Required arguments dataset-type Syntax: datamodel | savedsearch | inputlookup Description: The type of dataset that you want to use to join with the source data. To display the raw event data for the grouped events.įor information about when to use a join, see the flowchart in About event grouping and correlation in the Search Manual.For example, when a transaction does not explicitly end with a message and you want to specify a maximum span of time after the start of the transaction. To break up groups larger than a certain duration.To group events by using a pattern, such as a start or end time for the event.To group events by using a recycled field value, such as an ID or IP address.To group events by using the eval command with a conditional expression, such as if, case, or match.Use transaction in the following situations. To view the raw event data, use the transaction command instead.To use stats, the field must have a unique identifier.For example to determine the average duration of events by host name. To group events by a field and perform a statistical function on the events. In the most simple scenarios, you might need to search only for sources using the OR operator and then use a stats or transaction command to perform the grouping operation on the events. For example, a file from an external system such as a CSV file. Use when one of the result sets or source files remains static or rarely changes. The first subsearch result is merged with the first main result, the second subsearch result is merged with the second main result, and so on. You cannot use a transaction command after you use an append command.Īppends the fields of the subsearch results with the input search result fields. If you use append to combine the events, use a stats command to group the events in a meaningful way.The append command does not produce correct results if used in a real-time search. The events from both result sets are retained. To append the results of a subsearch to the results of your current search. These commands provide event grouping and correlations using time and geographic location, transactions, subsearches, field lookups, and joins. If you are familiar with SQL but new to SPL, see Splunk SPL for SQL users.įor flexibility and performance, consider using one of the following commands if you do not require join semantics. This maximum default is set to limit the impact of the join command on performance and resource consumption. | join left=L right=R where L.pid = R.pid Ī maximum of 50,000 rows in the right-side dataset can be joined with the left-side dataset.