Splunk Search

Join 2 search results where common field has multivalues in one search to display in single table

instabill1108
New Member

Trying to Join 2 search results (where the common field has multivalues in one of the searches) to display in single table

Splunk Query:
index="XYXY" sourcetype="XXX_product_details_csv" | join PARTNUMBER [search index="XYXY" host="ABDC*" "Entire Price call" AND "PriceServiceImpl" FAIL
| rex field=parts mode=sed "s/[/ /g"
| rex field=parts mode=sed "s/]/ /g"
| rex field=parts mode=sed "s/\ / /g"
| makemv delim="," parts
| mvexpand parts
| top parts
| rename parts AS PARTNUMBER]
| table PARTNUMBER BUYABLE PUBLISHED DISCONTINUED count
| rename count as "Failed Cart Count"

Above Query Doesn't work

If I hardcode a single part number into the query the join works -
index="XYXY" sourcetype="XXX_product_details_csv" | join PARTNUMBER [search index="XYXY" host="ABDC*" "Entire Price call" AND "PriceServiceImpl" FAIL
| rex field=parts mode=sed "s/[/ /g"
| rex field=parts mode=sed "s/]/ /g"
| rex field=parts mode=sed "s/\ / /g"
| makemv delim="," parts
| mvexpand parts
| top parts
| rename parts AS PARTNUMBER
| eval PARTNUMBER="128227" ]
| table PARTNUMBER SHORTDESCRIPTION BUYABLE PUBLISHED DISCONTINUED count
| rename count as "Failed Cart Count"

alt text

Results from Successful query....

Both searches work/ yield results independently of the join

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...