How to join data on my two sources (A and B) on the fields?

[boxmetal]

Hi, I need to join data on my 2 source A and B on the fields "Workitems_URL" and "Work Item URL" 

In source B, there is field "Type Name" that all of its join match must have this field contain value "Default" for a valid match.

If any of the matches do not have "Type Name" as "Default" then it will not be counted.

I tried to use a filter "Type Name"="Default" for the source B but it does not seem to be correct.

Please let me know how to make this work

Thanks

[ITWhisperer]

Please can you share the SPL that you have tried

[boxmetal]

Sure. It's like this

index="tdg1" host="005540" source="C:\\ALM\\CCM\\WorkItem\\Workitems.csv"
| join left=L right=R where L.Workitems_URL=R."Work Item URL"
[ search index="tdg1" source="C:\\ALM\\JRS\\TestCase_Test_WorkItem.csv" "Type Name"="Default"
]
| stats count

[ITWhisperer · Accepted solution]

Try like this

index="tdg1" host="005540" source="C:\\ALM\\CCM\\WorkItem\\Workitems.csv"
| join left=L right=R where L.Workitems_URL=R."Work Item URL"
[ search index="tdg1" source="C:\\ALM\\JRS\\TestCase_Test_WorkItem.csv"
| where 'Type Name'="Default"
]
| stats count

Note the single quotes around the field name in the where command