Splunk Search

why can't I use join to return all suited value?

pingpangbubai
Explorer

hi, all:
I want to link the two parts.The first is a csv file, the second is an index. The fileld name that i want to link is called "hash value", the search method I used is like that:

| inputcsv 201501 | eval HASH=hash | join HASH [search index="license" | rename HASH as hashkey | makemv delim=";" num | makemv delim=";" hashkey | eval fields = mvzip(num, hashkey) | mvexpand fields | rex field=fields "(?<alpha>.*),(?<beta>.*)" | rename alpha as num beta as HASH | dedup HASH] | table HASH

Unfortunately, from 3000 entries I had joined 2800, Some of the data in the two hundred could also be searched in the index "license", but not join successfully. And the HASH filed is multi-value in "license", I had expanded it. Why can't join command lind all suitable value? 
Could you give me some ideas, I've throught all the daytime, Thanks to all !  
0 Karma

lguinn2
Legend

If you set up your CSV file as a lookup table, this would be so much easier!! Setup a lookup and be sure to set a default value of "not found" to indicate if the lookup fails to find the key. Then this search will work:

 index="license" 
| rename HASH as hashkey 
| makemv delim=";" num 
| makemv delim=";" hashkey 
| eval fields = mvzip(num, hashkey) 
| mvexpand fields 
| rex field=fields "(?<alpha>.*),(?<beta>.*)" 
| rename alpha as num beta as HASH 
| dedup HASH
| lookup yourLookupTable HASH OUTPUT result
| table HASH
| where result!="not found"

This will work, even if you have a huge number of entries in the CSV file. If you have a smaller number, then you can do this

index="license" [ inputcsv 201501 ]
 | rename HASH as hashkey 
 | makemv delim=";" num 
 | makemv delim=";" hashkey 
 | eval fields = mvzip(num, hashkey) 
 | mvexpand fields 
 | rex field=fields "(?<alpha>.*),(?<beta>.*)" 
 | rename alpha as num beta as HASH 
 | dedup HASH
 | table HASH
0 Karma

pingpangbubai
Explorer

Hi, is there no need to use join again?

0 Karma

pingpangbubai
Explorer

And what's the reason of my problem?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...