Splunk Search

How to create a join when first search contains multivalues for single field?

Woodpecker
Path Finder

Hi,

I'm trying to join two searches where the first search includes a single field with multiple values. The matching field in the second search ONLY ever contains a single value. The search ONLY returns matches on the join when there are identical values for search 1 and search 2.

In other words if search 1 has a field named id, and contains field1=a and field2=b and the second search contains field2=b, results aren't looking as expected

The search will ONLY return results if search 1 contains a single value for field 1

Any suggestions on how to join a search with multiple values?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use mvexpand to expand the multivalue field prior to doing the join.

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...