Subsearch results are combined with an. Let's find the single most frequent shopper on the Buttercup Games online. Subsearch results are combined with an

 
 Let's find the single most frequent shopper on the Buttercup Games onlineSubsearch results are combined with an  You can also combine a search result set to itself using the selfjoin command

If this reply helps you, Karma would be appreciated. A relative time range is dependent on when the search. These factors lead to a truncation of results, which often goes unnoticed and leads to incorrect answers. appendcols won't work in this case for the reason you discovered and because it's rarely the answer to a Splunk problem. The required syntax is in bold. Splunk returns results in a table. If your subsearch returned a table, such as: | field1 | field2. Reply. The result of the subsearch is then used as an argument to the primary, or outer, search. 0 Karma. Subsearch produced 50000 results, truncating to 50000 - Need help! Shashank_87. I have a subsearch which searches for certain events (suspicious requests that sometimes happen after a user has logged into my system) inside an apache access log. What my user wants is a report with each row listing the Group name( in this case /uri_1*) but with the combined data for /uri_1 plus any sub uri returned. Specify a name for your Search Folder. For example, the first subsearch result is merged with the first main result, the second subsearch result is merged with the second main result, and so on. Events from the main search and subsearch are paired on a one-to-one basis without regard to any field value. To pass a field from the inner search to the outer search you must use the 'fields' command. Try following earliest=-40d [search index=b2bapps "*Order not fulfulled*" | stats count by OrderID | fields OrderID] | rexWhat is typically the best way to do splunk searches that following logic. I have a search that I need to filter by a field, using another search. The format at the end is implicit,. You do not need to specify the search command. Option 1: with a subsearch index=web sourcetype=access_combined status<400 [ search index=web sourcetype=access_combined status>=400 | dedup clientip | fields clientip ] | stats sum(b. Time ranges and subsearches Solution. You can use predicate expressions in the WHERE and. Consider the following raw event. In the case of # multiple definitions of the same setting, the last definition in the # file takes precedence. SplunkTrust. - TRUE - FALSE - TRUE Which return expression would return the first 3 values of the IP field as key-value pairs? - | return IP limit=3 This only works if i manually add the src_ip. Throttling an alert is different from configuring. The result of this condition is a boolean product of all comparisons within the list. Examples of streaming searches include searches with the following commands: search, eval, where,. Explorer ‎02-03-2020 10:46 AM. 3) Use the second result and inject it in the third search. Hi @jwhughes58, You can simply add dnslookup into your first search. The size of the list returned from a subsearch can be 10,000 items in size (modifiable in limits. This section lists. You can use subsearches to correlate data and evaluate events in the context of the whole event set, including data across different indexes or Splunk Enterprise servers in a distributed environment. fantasypros reviewSo let’s take a look. 3. For Type= 101 I don't have fields "Amount" and "Currency", so I'm extracting them through. Rows are called 'events' and columns are called 'fields'. 0 Karma Reply. Splunk supports nested queries. |eval test = [search sourcetype=any OR sourcetype=other. Gurwinder Singh. Tested it pretty extensively and I can find no differences. Just wondering if there's another method to expedite searching unstructured log files for all the values. spec file. Hello, I am trying to figure out how to combine the following search and subsearch into one search such that I can use real-time charts. The multisearch command is a generating command that runs multiple streaming searches at the same time. 0 Karma Reply. geomUse inputlookup in a subsearch to generate a large OR search of all the values seen in your lookup table. My subsearch results provide the keys necessary for the main one, but I'd like one extra field to be passed to the final table without being used on the outer search. So for instance if query has 26 results and q has 7, when I rename it like you said and do 'stats count by q' it brings back 26 results still instead of 33. Below is a search that runs and gives me the expected output of total of all IP's seen in the scans by System: | inputlookup scan_data_2. com access_combined source6 [email protected] Description. Each time the subsearch is run, the previous total is added to the value of the test field to calculate the new total. Generally, this takes the form of a list of events or a table. 17 Alabama 92-81 in the first round of the Emerald Coast. This search term ended up doing what I wanted: sourcetype=catalina* [ search sourcetype=catalina* eventtype=search_fail | fields + search_id ] It was useful to know that the sub-search operation implicitly appends a | format operator on to the end. 04-03-2020 09:57 AM. I'm hoping to pass the results from the first search to the second automatically. Working with subsearch. The IP is used as a search query in the outer search,. A subsearch is a search that is used to narrow down the set of events that you search on. M. The example below is similar to the multisearch example provided above and the results are the same. Technically it is possible to get the subsearch to return a search string that will work with NOT IN, the syntax would be. The filenames contain the source that we received the file from, and have a three digit sequence number as a suffix. You should get something that looks like. B. etc. With the dedup command, you can specify the number of duplicate events to keep for each value of a single field, or for each combination of values among several fields. Recommend that you: 1) Test the subsearch as a standard search to make sure it is working. My example is searching Qualys Vulnerability Data. 2) In second query I use the first result and inject it in here. Access lookup data by including a subsearch in the basic search with the ___ command. If you are not running the search directly on the LDAP server, you will have to specify the host with the “-H” option. If you can corelate on a particular field (and I can see you want to use PURCHASEID for this), use either selfjoin, transaction or even simple stats to group your events. [ search transaction_id="1" ] So in our example, the search that we need is. The query has to search two different sourcetypes , look for data (eventtype,file. The result of the subsearch is then provided as a criteria for the main search. Suppose we have these data:Summary. XML. In a simpler way, we can say it will combine 2 search queries and produce a single result. The foreach command is used to perform the subsearch for every field that starts with "test". The "inner" query is called a. The rex command performs field extractions using named groups in Perl regular expressions. 1. For example, the following search puts. Example 1: Search across all public indexes. Time ranges and subsearches Subsearch passes results to the outer search for filtering; therefore, subsearches work best if they produce a ___ result set. Combine the results from a search with the vendors dataset. I get this which is in turn passed to the first search. This last is the way you are apparently trying to use this subsearch. The inner search always runs first, and it’s important. conf). Syntax Appends the fields of the subsearch results with the input search results. I'm. You can retrieve events from your indexes, using keywords, quoted phrases, wildcards, and field-value expressions. If option override is false (default), if a. Subsearches in Splunk return results in the form field=value1 OR field=value2 OR field=value3 etc. 2. The multisearch command is a generating command that runs multiple streaming searches at the same time. To improve performance, the return command automatically limits the number of incoming results with the head command and the resulting fields. Trying to join 2 queries to find out the peak hour volume in last 90 days on a particular page. 01-20-2010 03:38 PM. This is an example of "subsearch result added as filter to base search". This command runs only over the historical data. join: Combine the results of a subsearch with the results of a main search. COVID-19 Response SplunkBase Developers Documentation. It is similar to the concept of subquery in case of SQL language. a) TRUE. When joining the subsearch and if all. sourcetype="access_combined_wcookie" (uri=/submitOrder) earliest=-7d@d [email protected] am trying correlate 2 different search queries using where with subsearch it goes like this: host="host1" | table Value1 above search give result : 40. Subsearches are enclosed in square brackets within a main search and are evaluated first. All the sha256 values returned from lookup will be added in the base search as a giant OR condition. First, lets start with a simple Splunk search for the recipient address. In your example, it would be something like this:Solved! Jump to solution. To learn more about the dedup command, see How the dedup command works . Complete the lookup expression. e the command is written after a pipe in SPL). If you use a join there needs to be a field with the same name in the subsearch (in your case, ESBDPUUID). Line 2 starts the subsearch. So, if the matching results you are expecting are outside of the limits, they will not be returned. Study with Quizlet and memorize flashcards containing terms like True or False: eventstats and streamstats support multiple stats functions, just like stats. 08-12-2016 07:22 AM. csv user Splunk - Subsearching. All you need to use this command is one or more of the exact. Description. Hi Splunkers, We are trying to pass variables from the subsearch to search, in this case from the subsearch we are getting 3 fields which will need to be in the SQL of the search. Issue 2 – Another problem with the Append and Join commands is that the subsearches timeout after 60 seconds and then auto-finalizes if you exceed this maximum execution time. index=* search result=abc | top status. Only show results which fulfil ANY of the below criteria; If eventcount>2 AND field1=somevaluehere OR If eventcount>5 AND field1=anothervaluehereBasically it is a function says: Matching the H1 (header) with BH2 (header in data lines), if this is the result able to match with the header --> take this AND if this is the result not able to match with the header, continue to match the next column in data lines. index=type1 EVENT_TYPE=Blah1 KEYFIELD=* | append [search index=type2 EVENT_TYPE=Blah2. returnWell if you're trying to get field values out of Search A index=a sourcetype=sta, and you want to use the field values in there to run another search B, and A might run into the millions of rows, then you can't use a subsearch. yoursearch [ inputlookup mylookup | fields ip ] The resulting search executed looks similar to: yoursearch AND ( ip=1. Summarize your search results into a report, whether tabular or other visualization format. Merging. Searching with != If you search with the != expression, every event that has a value in the field, where that value does not match the value you specify, is returned. So, by the time the subsearch finishes, the search command inside of [and ] will be textually replaced by the results of the subsearch - in this case avg_bytes=<some_number>. appendcols 108 Description Appends the fields of the subsearch results with the from CS 201 at Jawaharlal Nehru Technological University, KakinadaDownload topic as PDF. But still, if you have a big lookup table, the resulting subsearch would result in a big ugly set of conditions. 0 (1 review) Get a hint. The query has to search two different sourcetypes , look for data (eventtype,file. Subsearches work best for small result sets. Option 1: with a subsearch index=web sourcetype=access_combined status<400 [ search index=web sourcetype=access_combined status>=400 | dedup clientip | fields clientip ] | stats sum(b. Syntax. splunk Cheat Sheet Basic Commands Command Description Example search Initiates a search for events based on specifiedYes, I know the concept of subsearch. You can also combine a search result set to itself using the selfjoin command. These lookup output fields should overwrite existing fields. True. All you need to use this command is one or more of the exact. The multi search API executes several searches from a single API request. You can use the join command to combine the results of a main search (left-side dataset) with the results of either another dataset or a subsearch (right-side dataset). The results of the subsearch should not exceed available memory. The Search app consists of a web-based interface (Splunk Web), a. Using the NOT approach will also return events that are missing the field which is probably. Definition: 1) A subsearch is a search that is used to reduce the set of events from your result set. 1. Appends the results of a subsearch to the current results. Study with Quizlet and memorize flashcards containing terms like Which of the following booleans can be used in a search? ALSO OR NOT AND, Which search mode behaves differently depending on the type of search being run? Variable Fast Smart Verbose, When a search is run, in what order are events returned? Alphanumeric order Reverse. The makeresults command is used to generate a log_level field (column) with three rows i. hi raby1996, Appends the results of a subsearch to the current results. JSON. For example, a Boolean search could be “hotel” AND “New York”. This is used when you want to pass the values in the returned fields into the primary search. The problem is the subsearch returns multiple results and join takes only one from the returned set (that looks strange and not like in SQL). OR AND. 10-12-2021 02:04 PM. gentimes: Generates time-range results. A subsearch is a search that is used to narrow down the set of events that you search on. The "first" search Splunk runs is always the. Second Search (For each result perform another search, such as find list of vulnerabilities. some links: Functions for stats, chart and timechart (if you're going to memorize just one page in the Splunk documentation, make. For example: In my original search by. PubMed executes search commands from left to right and adds parenthesis to each step (see Search #1 and #2). I have a search which has a field (say FIELD1). Generally, this takes the form of a list of events or a table. My goal is to make a statistic table where the traffic data is coming from another log, but this traffic log is huge even if I narrow the search for one hour. inputlookup. 0 Karma Reply. access_combined source1 abc@mydomain. Subsearch results are combined with an ___ Boolean and attached to the outer search with an ___ Boolean OR, AND True or False: Subsearches are always executed first. I envision something like: index=network sourcetype=cisco [call existing report MalwareHits | rename ip as query | fields query] I know the search part works, but I hate to actually duplicate the entire malwarehits report inline. Create a new field that contains the result of a calculation; 2. 1. A coworker has asked you to help create a subsearch for a report. We and our partners store and/or access information on a device, such as cookies and process personal data, such as unique identifiers and standard information sent by a device for personalised ads and content, ad and content measurement, and audience insights, as well as to develop and improve products. noun. To learn more about the join command, see How the join command works . Subsearches: A subsearch returns data that a primary search requires. My goal is to make a statistic table where the traffic data is coming from another log, but this traffic log is huge even if I narrow the search for one hour. index=test sourcetype="access_combined_wcookie" ((req_content="/checkout/yourdetails" status=200) ORThe problem is what comes next - say the final field is "test_result" and I want to match all of the values of locx where the test_result is pass, but then I want to find the events where the locx from the test_result=pass is set, but only when locx is the second element in the colon separated version of the field, or when it's the only value. The foreach command loops over fields within a single event. e. Subsearch results are combined with an Boolean and attached to outer search with an Boolean. , Machine data can give you insights into: and more. Appends the fields of the subsearch results with the input search results. Subsearches are faster than other types of searches. foreach: Runs a templated streaming subsearch for each field in a wildcarded field list. The final total after all of the test fields are processed is 6. (host="foo" OR host="bar" OR host="baz") Add that to the main search to get. These audit tools contain analyst data about when they mark events as true positive, and withing CrowdStrike these are joined with the security event itself. Runals. Finally, the return command with $ returns the results of the eval, but without the field name itself. Change the format of subsearch results Create Statistical Tables and Chart Visualizations About transforming commands and searches Create time-based charts. e. For. if I correctly understand, you want to use the value of the field user as a free text search on your logs. The final table I want is as below: _time | ul-ctx-head-span-id | | duration |. For each field name, create a mv-field with all the values you want to match on, mvexpand this to create a row for each *_Employeestatus field crossed with each value. Turn off transparent mode federated search. View the History and Search Details section below the search and query boxes. This lookup fields may contain file names and directories and we are trying to make it work for both cases. In the subsearch below (the part inside square brackets), a list of unique lifecycleID values is produced and formatted into (lifecycleID="foo" OR lifecycleID="bar"). I’ll search for IP_Address on 1st search, then take that into 2nd search and find the Hostnames of those ip address…then display them. For example, the first subsearch result is merged with the first main result, the second subsearch result is merged with the second main result, and so on. So for instance if query has 26 results and q has 7, when I rename it like you said and do 'stats count by q' it brings back 26 results still instead of 33. Leveraging Lookups and Subsearches 18 October 2021 12 Lab Exercise 2 – Adding a Subsearch Description Create subsearches to manipulate search input. Subsearches are enclosed in square brackets within a main search and are evaluated first. Steps Return search results as key value pairs. search 1: searching for value next to "id" provide me listHi, maybe this approach can help to get into the right direction. i'm trying to use results from a subsearch to feed a search, however; 1) subsearch is results of a regex pullBy its nature, Splunk search can return multiple items. Appends the result of the subpipeline applied to the current result set to results. The search command is an generating command when it is the first command in the search. BrowseFirst i write the following query to count the events per host for blocked queues. PDF (for saved searches, using Splunk Web) Last modified on 14 March, 2023. 3 Karma. 2) The result of the subsearch is used as an argument to the primary or outer search. What character should wrap a subsearch? [ ] Brackets. This command is used implicitly by subsearches. oil of oregano dosage for yeast infection. The append command will run only over historical data; it will not produce correct results if used in a real-time search. If your windowed search does not display the expected number of events, try a non-windowed search. join Description. The append command attaches results of a subsearch to the _____ of current results. Removes the events that contain an identical combination of values for the fields that you specify. Rows are called 'events' and columns are called 'fields'. 08-05-2021 05:27 AM. 04-10-2018 10:29 PM. Because of this, you might hear us refer to two types of searches: Raw event searches. Use the map command to loop over events (this can be slow). 2|fields + srcIP dstIP|stats count by srcIP. I am trying to use subsearches to narrow down my searches and then use |join [search] to merge 3 tables with the same primary key "hostname". my answer is. Loads search results from a specified static lookup table. end. female anavar before and after pics redditThe command takes search results as input (i. <search> NOT your_field IN [ search <search> | stats count by your_field | fields your_field | rename your_field as search | format " (" "" "" "" "" ")" ] but there is no value in this for the OP's. For example, the first subsearch result is merged with the first main search result, the second subsearch result is merged with the second main search result, and so on. Then return a field for each *_Employeestatus field with the value to be searched. 2) Use lookup with specific inputs and outputs. The format command changes the subsearch results into a single linear search string. At a high level let's say you want not include something with "foo". com access_combined source7 abc@mydomain. will result in a search like such: litsearch index=blah 538 | fields keepcolorder=t * "*" "host" "index" "source" "sourcetype" "splunk_server". The following pieces of information should be provided for each result: “id”: the result ID “name”: the display name for the resultA subsearch takes the results from one search and uses the results in another search. Appends the fields of the subsearch results with the input search results. Subsearch output is converted to a query term that is used directly to constrain your search (via format):. 0 Karma Reply. and more. If using | return $<field>, the search will return: a) The 1st <field> and its value as a key-value pair. Here are two searches, which I think are logically equivalent, yet they return different results in Splunk. In the "Match type" box, enter "WILDCARD (name),WILDCARD (prename)". I have a scenario to combine the search results from 2 queries. The query is performed and relevant search data is extracted. On a lark, I happened to try using the fieldname query (instead of search), and then my subsearch returned more than one value. conf file. The subsearch is in square brackets and is run first. e. So, the sub search returns results like: Account1 Account2 Account3. The base search will only run once and the post-process search will use the cached base search as starting point for its post-process search. 88 OR 192. COVID-19 Response SplunkBase Developers Documentation. returnUsing nested subsearch where subsearch is results of a regex eddychuah. Change the format of subsearch results Create Statistical Tables and Chart Visualizations About transforming commands and searches Create time-based. ) and that string will be appended to the main. csv trans_id as tran OUTPUT app_id | timechart sum (count) by app_id | appendcols [search system=cics | timechart sum (cputime) as "overall CPU Time. AND, OR. There is no need subsearch; | localop | ldapsearch domain=my_domain search=" (& (objectCategory=Computer) (userAccountControl:1. I would like to search the presence of a FIELD1 value in subsearch. W. Let’s see a working example to understand the syntax. When searching or saving a search, you can specify absolute and relative time ranges using the following time modifiers: earliest=<time_modifier> latest=<time_modifier>. An example of a sub-search in a command is:You just have to adjust the field names to match your fields in events and lookup so the effective generated query would be built from the fields in the lookup but would reference the fields in the event. In particular, this will find the starting delivery events for this address, like the third log line shown above. HOUSE_DESC=ATL. <search> NOT your_field IN [ search <search> | stats count by your_field | fields your_field | rename your_field as search | format " (" "" "" "" "" ")" ] but there is no value in this for. Subsearches work best for joining two large result sets. The Search app consists of a web-based interface (Splunk Web), a. A subsearch runs its own search and returns the results to the parent command as the argument value. SyntaxSubsearch using boolean logic. Use the Browse… button to select which folders to search in. g. Hello, I am looking for a search query that can also be used as a dashboard. Examples of streaming searches include searches with the following commands: search, eval, where,. A subsearch is a search that is used to narrow down the set of events that you search on. Complete the lookup expression. 07-22-2011 06:25 AM. Hi Folks, We receive several hundred files per day from 20 different sources. display in the search results. This is used when you want to pass the values in the returned fields into the primary search. Command Use append To append the results of a subsearch to the results of your from CS 201 at Jawaharlal Nehru Technological University, KakinadaA magnifying glass. 10-26-2021 11:02 PM. where are results combined and processed? the search head. Topic #: 1. Remove duplicate search results with the same host value. Takes the results of a subsearch and formats them into a single result. Use the search command to retrieve events from indexes or filter the results of a previous search command in the pipeline. In Enterprise Security I am trying to combine results from two different source types by using "join" but facing problem with subsearch limits. So, the sub search returns results like: Account1 Account2 Account3. Subsearch output is converted to a query term that is used directly to constrain your search (via format):. Two specific field-value pairs are included in the search, status=200 and action=purchase. Syntax Then we have added two filters “action=view” and “status=200” (i. I was able to combine the subsearch results into a single event using transaction and get them joined anyway, but then the rest of the search becomes complicated with all these splitting back makemv. | dbxquery query="select sku from purchase_orders_line_item. The self-join command can also be used to join a collection of search results to itself. spec file. geomThe results are organized by the host field:. The most common use of the “OR” operator is to find multiple values in event data, e. 2) Use lookup with specific inputs and outputs. A subsearch runs its own search and returns the results to the parent command as the argument value. what is the final destination for even data? an index. Search optimization is a technique for making your search run as efficiently as possible. To see what the substitution is, run the subsearch with | format appended. PREVIOUS. Most search commands work with a single event at a time. The subsearch in this example identifies the most active host in the last hour. and more. Study with Quizlet and memorize flashcards containing terms like Subsearches are always executed first. Each result set must have at least one field in common. PRODUCT_ID=456. The artifacts to load are identified either by the search job id <sid> or a scheduled search name and the time range of the current search. So yeah - what I'm doing is asking "give me every hash that is a gif via the fileinfo sourcetype, now tell me if any of those hashes have been seen on our hosts via our host_hashes sourcetype, then finally append useful data right back from. 07-03-2016 08:48 PM. The sub searching is a very important part of the Splunk searching to search the data effectively in our data pool. If you are interested only in event counts, try using "timechart count" in your search. Advance innovation and accelerate patient outcomesUse subsearch results as data in outer search. Hello, I am working with Windows event logs in Splunk. Append command appends the result of a subsearch with the current result. The above search will be resolved asThis would make it MUCH easier to maintain code and simplify viewing big complex searches. Appends the fields of the subsearch results with the input search results. 1. For some reason the subsearch result from the subsearch index=index1 OR index=index2, the ip values do not get passed to the index3 search. It gets an array of result IDs as arguments, and should return a matching array of dictionaries (ie one a{sv} for each passed-in result ID). and Bruce Thornton combined for 52 points as Ohio State upset No. com access_combined source4 abc@mydomain. 2. The join command combines the results of the main search and subsearch using the join field backup_id. 08-05-2021 05:27 AM. dedup Description. Tags:Solution. 2) inputlookup is supposed to return the contents of the lookup, so the results you're getting are normal. Hello, I am looking for a search query that can also be used as a dashboard. When a subsearch is used as an argument to a "search" command, its output is implicitly passed through "format" (unless it has already been explicitly sent. Appends the fields of the subsearch results with the input search results. Basically I have a search from multiple different sources with lots of raw rex field extractions and transactions and evals. The second intermediate results table shows fewer columns, representing the results of the top command, "top user", which summarizes the events into a list of the top 10 users and displays the user, count, and percentage. I do however think you have your subsearch syntax backwards. 113556. yes but every subsearch requires an additional search which can risk memory and CPU can subsearches be nested? yes default time limit of subsearches 60 seconds (1 min) what is the subsearch event limit? can it be changed? 10,000 results. I am trying to get data from two different searches into the same panel, let me explain. Let's find the single most frequent shopper on the Buttercup Games online. It doesn’t show the correct result if you use this command in real time basis. This type of search is generally used when you need to access more data or combine two different searches together. You could try it with subsearch and exclusion (you'd need to enclose the subsearch in parentheses though) but it will be highly inefficient. Subsearches: A subsearch returns data that a primary search requires. Hi, I am dealing with a situation here. Thus there is no need to have scrollbars or collapsible containers; just display all results. maxtime = • Maximum number of seconds to run a subsearch before finalizing • Defaults to 60. 168. In my case, I need to use each result of subsearch as filter BUT as "contains" and not "equal to". I have a dashboard panel search that contains a subsearch that returns formatted results from three source types based on the username entered in the search field:02-16-2016 02:15 PM. sourcetype=srctype1 OR sourcetyp=srctype2 dstIP=1. A search pipeline that is enclosed in square brackets, the result of which is used as an argument in an outer or primary search. You can use search commands to extract fields in different ways. . Press the Choose… button. Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. The subsearch is run first before the command and is contained in square brackets. Select the Query Builder tab to construct your Boolean Search Query. This type of search is generally used when you need to access more data or combine two different searches together. But there are some many limitation on subsearch ( Ex: number of return records. Synopsis: Appends subsearch results to current results. If that FIELD1 value is present in subsearch results, then do work-1 (remaining search will change in direction-1), otherwise do work-2 (remaining search will change in direction-2). Regarding your first search string, somehow, it doesn't work as expected. g. Appends the result of the subpipeline to the search results. The above output is excluding the results of 2nd Query and 3rd Query from main search query result (1st Query) based on the field value of "User Id". You might also want to consider using a subsearch to get the ORDID values for a main search. 3. Example 3: Partition different searches to different indexes; in this example, you're searching three different indexes: main, _internal, and mail. 1. This enables sequential state-like data analysis. Reply. 0 Karma. csv user. The results are piped into the join command which uses the field backup_id as the join field.