I have joined two searches together. My search only returns one event that everything matches up but there are more than just one.
This is my search:
source="C:\\Users\\ragate\\Desktop\\splunk\\LMCustomerRevLicense.csv" | join type=left substr('context.custom.dimensions{}.LicenseKey',4,7) [search source="c:\\users\\ragate\\desktop\\splunk\\jsondump.txt"] | eval LicenseKeyID=substr('context.custom.dimensions{}.LicenseKey',4,7) | where 'LicenseKeyID'='License Key Identifier' |
Any suggestions?
Can you provide us with a sample jsondump.txt and csv?
Change type=left to type=outer on the join.
Did not work
Ok can you eval out the substring and use the field name in the join as opposed to the substring?
join type=outer fieldName
As opposed to
join type=outer substring(....
Like this
source="C:\\Users\\ragate\\Desktop\\splunk\\LMCustomerRevLicense.csv" |eval LicenseKeyID=substr('context.custom.dimensions{}.LicenseKey',4,7)| join type=outer LicenseKeyID [search source="c:\\users\\ragate\\desktop\\splunk\\jsondump.txt]
Removed the where too
Sorry for the late response but this did not work either.