Splunk Search

How to create a join when first search contains multivalues for single field?

Woodpecker
Path Finder

Hi,

I'm trying to join two searches where the first search includes a single field with multiple values. The matching field in the second search ONLY ever contains a single value. The search ONLY returns matches on the join when there are identical values for search 1 and search 2.

In other words if search 1 has a field named id, and contains field1=a and field2=b and the second search contains field2=b, results aren't looking as expected

The search will ONLY return results if search 1 contains a single value for field 1

Any suggestions on how to join a search with multiple values?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use mvexpand to expand the multivalue field prior to doing the join.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...