Splunk Search

why can't I use join to return all suited value?

pingpangbubai
Explorer

hi, all:
I want to link the two parts.The first is a csv file, the second is an index. The fileld name that i want to link is called "hash value", the search method I used is like that:

| inputcsv 201501 | eval HASH=hash | join HASH [search index="license" | rename HASH as hashkey | makemv delim=";" num | makemv delim=";" hashkey | eval fields = mvzip(num, hashkey) | mvexpand fields | rex field=fields "(?<alpha>.*),(?<beta>.*)" | rename alpha as num beta as HASH | dedup HASH] | table HASH

Unfortunately, from 3000 entries I had joined 2800, Some of the data in the two hundred could also be searched in the index "license", but not join successfully. And the HASH filed is multi-value in "license", I had expanded it. Why can't join command lind all suitable value? 
Could you give me some ideas, I've throught all the daytime, Thanks to all !  
0 Karma

lguinn2
Legend

If you set up your CSV file as a lookup table, this would be so much easier!! Setup a lookup and be sure to set a default value of "not found" to indicate if the lookup fails to find the key. Then this search will work:

 index="license" 
| rename HASH as hashkey 
| makemv delim=";" num 
| makemv delim=";" hashkey 
| eval fields = mvzip(num, hashkey) 
| mvexpand fields 
| rex field=fields "(?<alpha>.*),(?<beta>.*)" 
| rename alpha as num beta as HASH 
| dedup HASH
| lookup yourLookupTable HASH OUTPUT result
| table HASH
| where result!="not found"

This will work, even if you have a huge number of entries in the CSV file. If you have a smaller number, then you can do this

index="license" [ inputcsv 201501 ]
 | rename HASH as hashkey 
 | makemv delim=";" num 
 | makemv delim=";" hashkey 
 | eval fields = mvzip(num, hashkey) 
 | mvexpand fields 
 | rex field=fields "(?<alpha>.*),(?<beta>.*)" 
 | rename alpha as num beta as HASH 
 | dedup HASH
 | table HASH
0 Karma

pingpangbubai
Explorer

Hi, is there no need to use join again?

0 Karma

pingpangbubai
Explorer

And what's the reason of my problem?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...