https://community.splunk.com/t5/Splunk-Search/How-do-you-use-the-Join-command-even-if-the-substring-of-a/m-p/420523#M120850 <P>The <CODE>join</CODE> command matches the entire value of the joining field. There is no way to match substrings.</P> Mon, 04 Mar 2019 13:23:12 GMT richgalloway 2019-03-04T13:23:12Z https://community.splunk.com/t5/Splunk-Search/How-do-you-use-the-Join-command-even-if-the-substring-of-a/m-p/420522#M120849 <P>Hi,</P> <P>I want to join two searches based on a column, even if the substring of the two column matches .</P> <P>Below is my sample snippet.</P> <PRE><CODE>index=xx |rename "Vulnerable Machine" as VM| join type=left VM [search index=vmware sourcetype="vmware-tags-csv" earliest=-24h latest=now| rename vm_name as VM|eval VM=upper(VM)] </CODE></PRE> <P>Here, VM is the column I need to compare. Even if the substring of matches, it should join from the subsearch.</P> <P>Let me know if anyone has come across the same issue.</P> <P>Thanks</P> Mon, 04 Mar 2019 12:03:16 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-use-the-Join-command-even-if-the-substring-of-a/m-p/420522#M120849 Nadhiyaa 2019-03-04T12:03:16Z https://community.splunk.com/t5/Splunk-Search/How-do-you-use-the-Join-command-even-if-the-substring-of-a/m-p/420523#M120850 <P>The <CODE>join</CODE> command matches the entire value of the joining field. There is no way to match substrings.</P> Mon, 04 Mar 2019 13:23:12 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-use-the-Join-command-even-if-the-substring-of-a/m-p/420523#M120850 richgalloway 2019-03-04T13:23:12Z