Splunk Search

How to merge one query with another one that has the same field?

Ragate
Explorer

I currently have this search query:
source="C:\Users\ragate\Desktop\splunk\JsonDump.txt" | eval "LicenseKeyID"=substr('context.custom.dimensions{}.LicenseKey' ,4,7) | table "context.custom.dimensions{}.DocumentSessionId" "context.user.anonId" by LicenseKeyID |

I want to merge it with this one:
source="LMCustomerRevLicense.csv" $account_drop$ | dedup "Account Name" | table "License Key Identifier" "Account Name" "Total Revenue"

I made the License Keys be the same as the first source. I want to merge these two together and have everything sorted from the license key. I also want anything that does not match with the license keys in the first search to be removed. Is this possible?

0 Karma

woodcock
Esteemed Legend

@ppablo, please kill this question, it is a duplicate of this one:
https://answers.splunk.com/answers/668183/how-do-i-merge-two-fields-together-and-get-rid-of.html

0 Karma

woodcock
Esteemed Legend

Searches don't really help as much as post OPs think. What we REALLY need is sample data from each source and then a mockup of your desired output with some commentary. If you provide this, I can help.

0 Karma

Ragate
Explorer

Sure. The JsonDumb.txt file has these fields:
UserID context.custom.dimensions{}.LicenseKey context.custom.dimensions{}.DocumentSessionId
BM\jezeld CC-51TovCt-ST0-X-Q9946 This is a string of 20 random numbers and letters

For the LMCustomerRevLicense.csv I have these fields:
License Key Identifier Account Name Total Active Subscription Revenue _converted

51TovCt Johnson LLC 556,000

For these, the only thing I could find that would match these list together were the license keys. So I usesd substr in the first set of data to just keep the seven numbers and letters after the CC. I would like to merge these together so that I can have everything that does not match with the License Keys that have been substr to be removed. Is this possible with this information provided.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!