Hi,
I'm using the join command to join to searches based on a common field called ITEM. Based on this join, I want to return results from both searches only in instances where ITEM values match. However, I'm not sure it's working correctly. Could you please have a look at my query and let me know where I'm going wrong and what I could do to avoid using a join command:
index=index sourcetype=csv source=src1 host=host1| stats list(field1) as F_1 list(field2) as F_2 list(field3) as F_3 BY ITEM| eval source1=mvzip(F_1,mvzip(F_2,F_3)) | mvexpand source1 | rex field=source1 "(?<F_1>\d+),(?<F_2>\d+),(?<F_3>\d+)" | join ITEM [search index=index sourcetype=csv source=src2 host=host2| stats list(c_1) as C_1 list(c_2) as C_2 list(c_3) as C_3 BY SKU | eval source2=mvzip(C_1 ,mvzip(C_2,C_3)) | mvexpand source2| rex field=source2 "(?<C_1 >\d+),(?<C_2 >\d+),(?<C_3>\d+)" |rename SKU as ITEM] | eval DIFF1=F1-C_1 | eval DIFF2=F_2-C_2 | sort limit=0 ITEM |table ITEM, F_1, F_2, F_3, C_1, C_2, C_3, DIFF1, DIFF2
Can someone please check my query as I think there may be a mistake in there somewhere when attempting to create new records for instances where there are multiple values in a single field.
Thanks!
... View more