How do you use the Join command even if the substring of a particular column matches?

[Nadhiyaa]

Hi,

I want to join two searches based on a column, even if the substring of the two column matches .

Below is my sample snippet.

index=xx |rename "Vulnerable Machine" as VM| join type=left VM [search index=vmware sourcetype="vmware-tags-csv" earliest=-24h latest=now| rename vm_name as VM|eval VM=upper(VM)]

Here, VM is the column I need to compare. Even if the substring of matches, it should join from the subsearch.

Let me know if anyone has come across the same issue.

Thanks

[richgalloway]

The join command matches the entire value of the joining field. There is no way to match substrings.