Splunk Search

why can't I use join to return all suited value?

pingpangbubai
Explorer

hi, all:
I want to link the two parts.The first is a csv file, the second is an index. The fileld name that i want to link is called "hash value", the search method I used is like that:

| inputcsv 201501 | eval HASH=hash | join HASH [search index="license" | rename HASH as hashkey | makemv delim=";" num | makemv delim=";" hashkey | eval fields = mvzip(num, hashkey) | mvexpand fields | rex field=fields "(?<alpha>.*),(?<beta>.*)" | rename alpha as num beta as HASH | dedup HASH] | table HASH

Unfortunately, from 3000 entries I had joined 2800, Some of the data in the two hundred could also be searched in the index "license", but not join successfully. And the HASH filed is multi-value in "license", I had expanded it. Why can't join command lind all suitable value? 
Could you give me some ideas, I've throught all the daytime, Thanks to all !  
0 Karma

lguinn2
Legend

If you set up your CSV file as a lookup table, this would be so much easier!! Setup a lookup and be sure to set a default value of "not found" to indicate if the lookup fails to find the key. Then this search will work:

 index="license" 
| rename HASH as hashkey 
| makemv delim=";" num 
| makemv delim=";" hashkey 
| eval fields = mvzip(num, hashkey) 
| mvexpand fields 
| rex field=fields "(?<alpha>.*),(?<beta>.*)" 
| rename alpha as num beta as HASH 
| dedup HASH
| lookup yourLookupTable HASH OUTPUT result
| table HASH
| where result!="not found"

This will work, even if you have a huge number of entries in the CSV file. If you have a smaller number, then you can do this

index="license" [ inputcsv 201501 ]
 | rename HASH as hashkey 
 | makemv delim=";" num 
 | makemv delim=";" hashkey 
 | eval fields = mvzip(num, hashkey) 
 | mvexpand fields 
 | rex field=fields "(?<alpha>.*),(?<beta>.*)" 
 | rename alpha as num beta as HASH 
 | dedup HASH
 | table HASH
0 Karma

pingpangbubai
Explorer

Hi, is there no need to use join again?

0 Karma

pingpangbubai
Explorer

And what's the reason of my problem?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...