I have two look up and both have a field called DNS. I need to figure out which values in those fields match. I have tried the below per a different thread, which in theory is what I'm looking for, but I kept getting an error (Error in 'from' command: Invalid dataset specifier) at the join command on line 3.
Similar issue but solution didn't work
| inputlookup Test1.csv
| fields UserName, Count | rename Count as Count1
| join type=inner UserName
[| inputlookup Test2.csv
| fields UserName, Count | rename Count as count2]
Check the search log to see if there's better information about that error.
This query might give you the results you want.
| inputlookup Test1.csv
| fields UserName, Count | rename Count as Count1
| append [ | inputlookup Test2.csv
| fields UserName, Count | rename Count as count2 ]
| stats values(*) as * by UserName
Instead of expensive join, you can simply perform a lookup which is efficient.
| inputlookup Test1.csv
| fields UserName, Count | rename Count as Count1
| lookup Test2.csv UserName OUTPUT Count as count2
| where isnotnull(count2)
Check the search log to see if there's better information about that error.
This query might give you the results you want.
| inputlookup Test1.csv
| fields UserName, Count | rename Count as Count1
| append [ | inputlookup Test2.csv
| fields UserName, Count | rename Count as count2 ]
| stats values(*) as * by UserName