topic Join command not working in Splunk Search

Join command not working

user2020dy — Thu, 08 Oct 2020 15:45:48 GMT

I want to extend the results of the first search : add the column category (from the 2 search) to the results of the 1 search.

The results of the first search appear:

The results of the 2 search are also present:

2 datasets have one common field dns_query .

But using join command no matches are found in these 2 datasets are found (it`s impossible, because I checked some of the dns_query )

Any ideas what can be wrong?

Re: Join command not working

ashajambagi — Thu, 08 Oct 2020 17:26:02 GMT

Hi @user2020dy

You need to specify dns_query in the second search

[search `umbrella`|fields category dns_query]

Re: Join command not working

user2020dy — Fri, 09 Oct 2020 06:05:00 GMT

Have tried already both variants, not working 😞

Re: Join command not working

ITWhisperer — Fri, 09 Oct 2020 09:11:58 GMT

While google.com exists in the dns_query fields, there isn't a complete match hence no results. You should evaluate the presence of google.com into another field in both searches and join on that field.

| rex field=dns_query "(?<google>google.com)"

Re: Join command not working

to4kawa — Fri, 09 Oct 2020 10:46:57 GMT

1st search result dns_query:
XXX.google.com

2nd search result dns_query:
XXX.google.com.

There is extra asterisk on 2nd search.

[search `umbrella`|fields category dns_query| eval dns_query=dns_query."."]

how about this?