Match a column from a main query with a column in a subquery

[ravikumar_sri20]

Hi Experts,

The file ACF2DS_Data.csv contains columns including TIMESTAMP, DS_NAME, and JOBNAME.

I need to match the DS_NAME column from this file with the LKUP_DSN column in DSN_LKUP.csv to obtain the corresponding events from ACF2DS_Data.csv.

The query provided below is not working as expected.

Could you please assist me in resolving the issue with the query?

source="*ACF2DS_Data.csv" index="idxmainframe" earliest=0 latest=now
[search source="*DSN_LKUP.csv" index="idxmainframe" earliest=0 latest=now
| eval LKUP_DSN = "%".LKUP_DSN."%"
| where like(DS_NAME,LKUP_DSN) | table DS_NAME]
| table TIMESTAMP, DS_NAME, JOBNAME

Thanks,
Ravikumar

[richgalloway]

If you need to match the LKUP_DSN field in the subsearch with the DS_NAME field in the main search then LKUP_DSN must renamed to DS_NAME.

source="*ACF2DS_Data.csv" index="idxmainframe" earliest=0 latest=now
[search source="*DSN_LKUP.csv" index="idxmainframe" earliest=0 latest=now
  | rename LKUP_NAME as DS_NAME
  | fields DS_NAME
  | format ]
| table TIMESTAMP, DS_NAME, JOBNAME

[ravikumar_sri20]

Hi,

Thanks for your reply!!..I need to do partial match on LKUP_DSN.  Could you please help ?

Thanks,

Ravikumar

[richgalloway]

Tell us more about the partial match on LKUP_DSN.  What is it matched against?  What part needs to match?

[ravikumar_sri20]

The file ACF2DS_Data.csv comprises columns such as TIMESTAMP, DS_NAME, and JOBNAME.

I need to perform a partial match of the LKUP_DSN column from the DSN_LKUP.csv file with the DS_NAME column in the ACF2DS_Data.csv file in order to retrieve the relevant events from ACF2DS_Data.csv.

[richgalloway]

What constitutes a match between LKUP_DSN and DS_NAME?  How much of DS_NAME is allowed to vary?

[ravikumar_sri20]

At times, LKUP_DSN will match exactly with DS_NAME. In other instances, LKUP_DSN will contain all the characters of DS_NAME except for the last nine characters.