I have 2 tables
I'd like to join the tables.
for example :
A table
str1 |
str2 |
str3 |
B table
str4 | val1 | oval1 |
str5 | val2 | oval2 |
str6 | val3 | oval3 |
result : A + B table
str1 | str4 | val1 | oval1 |
str1 | str5 | val2 | oval2 |
str1 | str6 | val3 | oval3 |
str2 | str4 | val1 | oval1 |
str2 | str5 | val2 | oval2 |
str2 | str6 | val3 | oval3 |
str3 | str4 | val1 | oval1 |
str3 | str5 | val2 | oval2 |
str3 | str6 | val3 | oval3 |
thank you.
Assuming f1.csv contains the values of table A with field name f1 and tableb.csv contains the values of table b with field names C1, C2 and C3 the following does what you want
| inputlookup f1.csv
| append
[
| inputlookup tableb.csv
| eval B=C1.",".C2.",".C3
| table B
]
| eventstats values(B) as B
| where !isnull(f1)
| mvexpand B
| rex field=B "(?<C1>[^,]*),(?<C2>[^,]*),(?<C3>.*)"
| table f1, C1, C2, C3
Hope this helps
Are you going to talk about Splunk? where is the field name?
sample:
| makeresults
| eval Atable=split("str1,str2,str3",",")
| mvexpand Atable
| append [|makeresults| eval _raw="str,val,oval
str4,val1,oval1
str5,val2,oval2
str6,val3,oval3"
| multikv forceheader=1 ]
| eventstats list(Atable) as Atable
| mvexpand Atable
| where !isnull(linecount)
| table Atable str val oval
Assuming f1.csv contains the values of table A with field name f1 and tableb.csv contains the values of table b with field names C1, C2 and C3 the following does what you want
| inputlookup f1.csv
| append
[
| inputlookup tableb.csv
| eval B=C1.",".C2.",".C3
| table B
]
| eventstats values(B) as B
| where !isnull(f1)
| mvexpand B
| rex field=B "(?<C1>[^,]*),(?<C2>[^,]*),(?<C3>.*)"
| table f1, C1, C2, C3
Hope this helps
Thank you, I solved it:)