Splunk Search

How to merge one query with another one that has the same field?

Ragate
Explorer

I currently have this search query:
source="C:\Users\ragate\Desktop\splunk\JsonDump.txt" | eval "LicenseKeyID"=substr('context.custom.dimensions{}.LicenseKey' ,4,7) | table "context.custom.dimensions{}.DocumentSessionId" "context.user.anonId" by LicenseKeyID |

I want to merge it with this one:
source="LMCustomerRevLicense.csv" $account_drop$ | dedup "Account Name" | table "License Key Identifier" "Account Name" "Total Revenue"

I made the License Keys be the same as the first source. I want to merge these two together and have everything sorted from the license key. I also want anything that does not match with the license keys in the first search to be removed. Is this possible?

0 Karma

woodcock
Esteemed Legend

@ppablo, please kill this question, it is a duplicate of this one:
https://answers.splunk.com/answers/668183/how-do-i-merge-two-fields-together-and-get-rid-of.html

0 Karma

woodcock
Esteemed Legend

Searches don't really help as much as post OPs think. What we REALLY need is sample data from each source and then a mockup of your desired output with some commentary. If you provide this, I can help.

0 Karma

Ragate
Explorer

Sure. The JsonDumb.txt file has these fields:
UserID context.custom.dimensions{}.LicenseKey context.custom.dimensions{}.DocumentSessionId
BM\jezeld CC-51TovCt-ST0-X-Q9946 This is a string of 20 random numbers and letters

For the LMCustomerRevLicense.csv I have these fields:
License Key Identifier Account Name Total Active Subscription Revenue _converted

51TovCt Johnson LLC 556,000

For these, the only thing I could find that would match these list together were the license keys. So I usesd substr in the first set of data to just keep the seven numbers and letters after the CC. I would like to merge these together so that I can have everything that does not match with the License Keys that have been substr to be removed. Is this possible with this information provided.

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...