Splunk Search

Join 2 search results where common field has multivalues in one search to display in single table

New Member

Trying to Join 2 search results (where the common field has multivalues in one of the searches) to display in single table

Splunk Query:
index="XYXY" sourcetype="XXXproductdetails_csv" | join PARTNUMBER [search index="XYXY" host="ABDC*" "Entire Price call" AND "PriceServiceImpl" FAIL
| rex field=parts mode=sed "s/[/ /g"
| rex field=parts mode=sed "s/]/ /g"
| rex field=parts mode=sed "s/\ / /g"
| makemv delim="," parts
| mvexpand parts
| top parts
| rename parts AS PARTNUMBER]
| table PARTNUMBER BUYABLE PUBLISHED DISCONTINUED count
| rename count as "Failed Cart Count"

Above Query Doesn't work

If I hardcode a single part number into the query the join works -
index="XYXY" sourcetype="XXXproductdetails_csv" | join PARTNUMBER [search index="XYXY" host="ABDC" "Entire Price call" AND "PriceServiceImpl" FAIL
| rex field=parts mode=sed "s/[/ /g"
| rex field=parts mode=sed "s/]/ /g"
| rex field=parts mode=sed "s/\ / /g"
| makemv delim="," parts
| mvexpand parts
| top parts
| rename parts AS PARTNUMBER
*
| eval PARTNUMBER="128227" ]**
| table PARTNUMBER SHORTDESCRIPTION BUYABLE PUBLISHED DISCONTINUED count
| rename count as "Failed Cart Count"

alt text

Results from Successful query....

Both searches work/ yield results independently of the join

0 Karma