It is somewhat confusing what that mvexpand is supposed to do and why string merge is necessary. As I last commented in your other post, there is nothing wrong with Splunk's left join. Even though ...
See more...
It is somewhat confusing what that mvexpand is supposed to do and why string merge is necessary. As I last commented in your other post, there is nothing wrong with Splunk's left join. Even though I want to avoid join in general, join is better than doing all that extra work. Here is my emulation: | makeresults format=csv data="ip_address, host
10.1.1.1, host1
10.1.1.2, host2
10.1.1.3, host3
10.1.1.4, host4
10.1.1.5, host5
10.1.1.6, host6
10.1.1.7, host7"
| rename ip_address as ip
| join max=0 type=left ip
[makeresults format=csv data="ip, risk, score, contact
10.1.1.1, riskA, 6, ,
10.1.1.1, riskB, 7 ,
10.1.1.1, ,, person1,
10.1.1.1, riskC, 6,,
10.1.1.2, ,, person2,
10.1.1.3, riskA, 6, person3,
10.1.1.3, riskE, 7, person3,
10.1.1.4, riskF, 8, person4,
10.1.1.8, riskA, 6, person8,
10.1.1.9, riskB, 7, person9"]
| table ip, host, risk, score, contact The output is ip host risk score contact 10.1.1.1 host1 riskA 6 10.1.1.1 host1 riskB 7 10.1.1.1 host1 person1 10.1.1.1 host1 riskC 6 10.1.1.2 host2 person2 10.1.1.3 host3 riskA 6 person3 10.1.1.3 host3 riskE 7 person3 10.1.1.4 host4 riskF 8 person4 10.1.1.5 host5 10.1.1.6 host6 10.1.1.7 host7 Hope this helps. (And thanks for posting data emulation. That makes things easier.)