Hi @nasrinmulani,
If your data set is small, you can go for joins:
Created two data sets :
first data set contains :
a1 - {1,2,3}
b1 - {4,5,6}
second data set contains :
a1 - {1,2,3}
b1 - {4,7,8}
I think your expected outcome from the both above data sets is (1,4). if this is correct then the below solution will for you. here I have taken only two fields in join command you can take any number of fields in join.
| makeresults
| eval a1="1:4,2:5,3:6"
| makemv a1 delim=","| mvexpand a1
| rex field=a1 "(?<a1>\d):(?<b1>\d)"
| join type=left a1,b1 [| makeresults
| eval a1="1:4,2:7,3:8"
| makemv a1 delim=","| mvexpand a1
| rex field=a1 "(?<a1>\d):(?<b1>\d)" | eval source="innerJoin"]
Happy Splunking..:)
... View more
