topic Re: Match a column from a main query with a column in a subquery in Splunk Search

Match a column from a main query with a column in a subquery

ravikumar_sri20 — Thu, 13 Feb 2025 14:32:31 GMT

Hi Experts,

The file ACF2DS_Data.csv contains columns including TIMESTAMP, DS_NAME, and JOBNAME.

I need to match the DS_NAME column from this file with the LKUP_DSN column in DSN_LKUP.csv to obtain the corresponding events from ACF2DS_Data.csv.

The query provided below is not working as expected.

Could you please assist me in resolving the issue with the query?

source="*ACF2DS_Data.csv" index="idxmainframe" earliest=0 latest=now
[search source="*DSN_LKUP.csv" index="idxmainframe" earliest=0 latest=now
| eval LKUP_DSN = "%".LKUP_DSN."%"
| where like(DS_NAME,LKUP_DSN) | table DS_NAME]
| table TIMESTAMP, DS_NAME, JOBNAME

Thanks,
Ravikumar

Re: Match a column from a main query with a column in a subquery

richgalloway — Thu, 13 Feb 2025 15:13:43 GMT

If you need to match the LKUP_DSN field in the subsearch with the DS_NAME field in the main search then LKUP_DSN must renamed to DS_NAME.

source="*ACF2DS_Data.csv" index="idxmainframe" earliest=0 latest=now [search source="*DSN_LKUP.csv" index="idxmainframe" earliest=0 latest=now | rename LKUP_NAME as DS_NAME | fields DS_NAME | format ] | table TIMESTAMP, DS_NAME, JOBNAME

Re: Match a column from a main query with a column in a subquery

ravikumar_sri20 — Thu, 13 Feb 2025 17:19:57 GMT

Hi,

Thanks for your reply!!..I need to do partial match on LKUP_DSN. Could you please help ?

Thanks,

Ravikumar

Re: Match a column from a main query with a column in a subquery

richgalloway — Thu, 13 Feb 2025 19:30:45 GMT

Tell us more about the partial match on LKUP_DSN. What is it matched against? What part needs to match?

Re: Match a column from a main query with a column in a subquery

ravikumar_sri20 — Fri, 14 Feb 2025 07:19:45 GMT

The file ACF2DS_Data.csv comprises columns such as TIMESTAMP, DS_NAME, and JOBNAME.

I need to perform a partial match of the LKUP_DSN column from the DSN_LKUP.csv file with the DS_NAME column in the ACF2DS_Data.csv file in order to retrieve the relevant events from ACF2DS_Data.csv.

Re: Match a column from a main query with a column in a subquery

richgalloway — Fri, 14 Feb 2025 12:29:39 GMT

What constitutes a match between LKUP_DSN and DS_NAME? How much of DS_NAME is allowed to vary?

Re: Match a column from a main query with a column in a subquery

ravikumar_sri20 — Mon, 17 Feb 2025 05:49:42 GMT

At times, LKUP_DSN will match exactly with DS_NAME. In other instances, LKUP_DSN will contain all the characters of DS_NAME except for the last nine characters.