Outer Join not working

[robertlynch2020]

I have data in a CSV called 25_million_Linie_Rule.csv (example below)

host,source,count
"INTERFACES_BUILD","/hp547srv1/apps/INTERFACES_BUILD/logs/traces/mxtiming_956675_hp547srv.fr.murex.com_**1254**.log",31436700

I also have data in real time.
If the data in rela time is the same as the .csv i don'twant to report it . So an outer join is needed, but i cant get it to work.

| tstats count where index="mlc_live" OR index="mxtiming_live" by host source 
| dedup source 
| sort 0 - count 
| head 10 
| where count > 25000000 
| table host source count 
| join type=outer source  
    [| inputlookup 25_million_Linie_Rule.csv  ]

OUTPUT is below (However i get a line i already have in the csv, i should only get one line, the new line not the one i have in the .csv )

host    source  count
INTERFACES_BUILD    /hp547srv1/apps/INTERFACES_BUILD/logs/traces/mxtiming_956675_hp547srv.fr.murex.com_**1254**.log 31436700
INTERFACES_BUILD    /hp547srv1/apps/INTERFACES_BUILD/logs/traces/mxtiming_956678_hp547srv.fr.murex.com_**1992**.log 26617140

Any help would be great
Rob

[to4kawa · Accepted solution]

 | tstats count where index="mlc_live" OR index="mxtiming_live" by host source 
 | dedup source 
 | sort 0 - count 
 | head 10 
 | where count > 25000000 
 | table host source count 
 | join type=outer source  
     [| inputlookup 25_million_Linie_Rule.csv 
       | eval  csv=1]
 | where isnull(csv)
 | table host source count 

[robertlynch2020]

Brill - thanks 🙂

[robertlynch2020]

Thanks for the replay,

but i get

Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.

[to4kawa]

sorry, @robertlynch2020
I forgot to erase it. my answer is updated.

[13tsavage]

I think the join is working as intended. Because the same event that lives in your 25_million_Linie_Rule.csv also would be found in your real-time main search. Doing the join should not remove events found in your main search that match those events in your 25_million_Linie_Rule.csv as I think you want.