Splunk Search

How to merge one query with another one that has the same field?

Ragate
Explorer

I currently have this search query:
source="C:\Users\ragate\Desktop\splunk\JsonDump.txt" | eval "LicenseKeyID"=substr('context.custom.dimensions{}.LicenseKey' ,4,7) | table "context.custom.dimensions{}.DocumentSessionId" "context.user.anonId" by LicenseKeyID |

I want to merge it with this one:
source="LMCustomerRevLicense.csv" $account_drop$ | dedup "Account Name" | table "License Key Identifier" "Account Name" "Total Revenue"

I made the License Keys be the same as the first source. I want to merge these two together and have everything sorted from the license key. I also want anything that does not match with the license keys in the first search to be removed. Is this possible?

0 Karma

woodcock
Esteemed Legend

@ppablo, please kill this question, it is a duplicate of this one:
https://answers.splunk.com/answers/668183/how-do-i-merge-two-fields-together-and-get-rid-of.html

0 Karma

woodcock
Esteemed Legend

Searches don't really help as much as post OPs think. What we REALLY need is sample data from each source and then a mockup of your desired output with some commentary. If you provide this, I can help.

0 Karma

Ragate
Explorer

Sure. The JsonDumb.txt file has these fields:
UserID context.custom.dimensions{}.LicenseKey context.custom.dimensions{}.DocumentSessionId
BM\jezeld CC-51TovCt-ST0-X-Q9946 This is a string of 20 random numbers and letters

For the LMCustomerRevLicense.csv I have these fields:
License Key Identifier Account Name Total Active Subscription Revenue _converted

51TovCt Johnson LLC 556,000

For these, the only thing I could find that would match these list together were the license keys. So I usesd substr in the first set of data to just keep the seven numbers and letters after the CC. I would like to merge these together so that I can have everything that does not match with the License Keys that have been substr to be removed. Is this possible with this information provided.

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...