Join command not working

[user2020dy]

I want to extend the results of the first search : add the column category  (from the 2 search) to the results of the 1 search.

The results of the first search appear:

user2020dy_0-1602171116551.png

The results of the 2 search are also present:

user2020dy_1-1602171168287.png

 2 datasets have one common field dns_query  .

But using join command no matches are found in these 2 datasets are found (it`s impossible, because I checked some of the dns_query )

Any ideas what can be wrong?

[to4kawa]

1st search result dns_query:
  XXX.google.com

2nd search result dns_query:
  XXX.google.com.

There is extra asterisk on 2nd search.

[search `umbrella`|fields category dns_query| eval dns_query=dns_query."."]

how about this?

[ITWhisperer]

While google.com exists in the dns_query fields, there isn't a complete match hence no results. You should evaluate the presence of google.com into another field in both searches and join on that field.

| rex field=dns_query "(?<google>google.com)"

[ashajambagi]

Hi  @user2020dy 

You need to specify dns_query in the second search 

[search `umbrella`|fields category dns_query]

[user2020dy]

Have tried already both variants, not working 😞