How do I join a search with a list of jobnames from a file DepC_listofjobs.csv?

[mihir_hardas]

How do I join a search with a list of jobnames from a file DepC_listofjobs.csv. This file has only one column which has unique jobnames.

Below command, if I uncomment the line

earliest=-8h index=log-13120-prod-c laas_appId="pbmp.prediction*" "Prediction"

```| join [ inputlookup DepC_listofjobs.csv ]```

 | bin _time span=1h

 | stats dc(predictionId),dc(jobName), count by _time  predictionStatus

[mihir_hardas]

The below SPL works but gives very less data than expected

earliest=-2d index=log-13120-prod-c laas_appId="pbmp.prediction*" "Prediction"
| rename jobName as jobname

| join [ inputlookup DepC_listofjobs.csv ]

| bin _time span=1h

| stats dc(predictionId),dc(jobname), count by _time predictionStatus

[starcher]

Why are you joining instead of just not using the lookup as a lookup?

[mihir_hardas]

I need to expliticity use a join+subsearch because below SPL gives no rows returned

earliest=-8h index=log-13120-prod-c laas_appId="pbmp.prediction*" "Prediction"

| join [ inputlookup DepC_listofjobs.csv ]

 | bin _time span=1h

 | stats dc(predictionId),dc(jobName), count by _time  predictionStatus


sample event in the index is pasted below

2022-11-10 00:18:20.353 [task-25483] INFO c.m.b.p.s.p.PredictionRunner#lambda$run$2 - predictionId=e5e2a703-13c6-4c15-addc-9f2c114733ec, job=PADT-HUB-P-D-G-RS-PTY-ADDR-DLT-INS^PNA predicted as Prediction(predictionId=e5e2a703-13c6-4c15-addc-9f2c114733ec, jobName=PADT-HUB-P-D-G-RS-PTY-ADDR-DLT-INS, instance=PNA, predictionStatus=PREDICTED, predictedStartTime=1668067804, predictedFinishTime=1668067880, predictionExplanation=PREDICTED, predictedAt=1668057500)