How to join with one key but multiple results?

fereze — Thu, 30 Jun 2022 22:29:28 GMT

Hi I have a table similar to this:

Brand ID_EMP

Nike 123

Adidas 456

Lotto 123

other table like this:

code name

123 Smith

456 Myers

The result should be

Nike 123 Smith

Adidas 456 Myers

Lotto 123 Smith

but insted of this I'm getting:

Nike 123 Smith john

adidas 456 Myers. Mike

This is the query that I'm using.

Re: How to join with one key but multiple results?

nadlurinadluri — Thu, 30 Jun 2022 22:42:48 GMT

Please find the sample query with the data points, hope it helps you to change your query accordingly -

Also, in most of the cases you can skip using join command if one of your datasources is a lookupfile, you can use |lookup filename.csv command in those cases.

Considering the below is in lookupfile emp.,csv

code name 123 Smith 456 Myers

Final Query -

Let me know if the above query helped or if you feel anything needs to be changed in the above example.

topic How to join with one key but multiple results? in Splunk Search

How to join with one key but multiple results?

Re: How to join with one key but multiple results?