join only with the first row

rafadvega — Wed, 10 Nov 2021 17:46:54 GMT

Hi,

I need to join two searchs. For example:

Example 1:

| inputlookup join_example1.csv

Example 2:

| inputlookup join_example2.csv

If I join bot searchs:

| inputlookup join_example1.csv | join product, day [| inputlookup join_example2.csv] | table product day country stock requested

The result is:

But I need the sub search merges only with the first result like this (only in one country):

That is only a example, I need only merge subsearchs results once. Anyone knows a solution for this?

Thanks!!!

Re: join only with the first row

bowesmana — Wed, 10 Nov 2021 21:50:18 GMT

You can add this to the end of your example search

| streamstats c by product day | eval requested=if(c=1,requested,0) | fields - c

which simply does a count by product and day and then sets requested to 0 if the count value is not 1

Not sure if this will give you a general solution though.

rafadvega — Thu, 11 Nov 2021 07:30:28 GMT

That is a perfect solution. Thank you very much!