How to use join for 2 CSV files?

[woodlandrelic]

Hi ,

Am trying to join 2 lookups. when I run them individually they are fine but I use the join command it takes forever.  Is there a better and more efficient way to join them.  The query used is below.

Thanks

| inputlookup compliance_data_high_severity.csv

|join type=inner max=0 [
|inputlookup KononKV_system
|where isnotnull(devices)
|eval devices=split(devices, "|delim|")
|eval data=split(data, "|delim|")
|mvexpand devices
|spath input=devices "IP Address" output=ip
|spath input=devices "Component Type"
|spath input=devices "Operating System"
|spath input=data "System Acronym"
`is_server("Operating System", "Component Type", is_server)`
|search is_server="*"
|fields ip "Operating System" "Component Type"

]

[seemanshu · Accepted solution]

Hi @woodlandrelic ,

In the above shared search, you need to mention a common field among the  fields (ip "Operating System" "Component Type") in order to make the join work.
So, the updated search should look like, here i am assuming "ip" to be the common field for joining,

| inputlookup compliance_data_high_severity.csv

|join type=inner max=0 ip[
|inputlookup KononKV_system
|where isnotnull(devices)
|eval devices=split(devices, "|delim|")
|eval data=split(data, "|delim|")
|mvexpand devices
|spath input=devices "IP Address" output=ip
|spath input=devices "Component Type"
|spath input=devices "Operating System"
|spath input=data "System Acronym"
`is_server("Operating System", "Component Type", is_server)`
|search is_server="*"
|fields ip "Operating System" "Component Type"

]

Kindly upvote the answer, if found useful.
Happy Splunking!

[woodlandrelic]

@seemanshu 

Sorry for the late reply.  Your answer make so much sense helped my understanding better. Thank you again!