Splunk Enterprise

How to use join for 2 CSV files?

woodlandrelic
Path Finder

Hi ,

Am trying to join 2 lookups. when I run them individually they are fine but I use the join command it takes forever.  Is there a better and more efficient way to join them.  The query used is below.

Thanks

 

| inputlookup compliance_data_high_severity.csv

|join type=inner max=0 [
|inputlookup KononKV_system
|where isnotnull(devices)
|eval devices=split(devices, "|delim|")
|eval data=split(data, "|delim|")
|mvexpand devices
|spath input=devices "IP Address" output=ip
|spath input=devices "Component Type"
|spath input=devices "Operating System"
|spath input=data "System Acronym"
`is_server("Operating System", "Component Type", is_server)`
|search is_server="*"
|fields ip "Operating System" "Component Type"

]

 

Labels (2)
Tags (1)
0 Karma
1 Solution

seemanshu
Path Finder

Hi @woodlandrelic ,

In the above shared search, you need to mention a common field among the  fields (ip "Operating System" "Component Type") in order to make the join work.
So, the updated search should look like, here i am assuming "ip" to be the common field for joining,

| inputlookup compliance_data_high_severity.csv

|join type=inner max=0 ip[
|inputlookup KononKV_system
|where isnotnull(devices)
|eval devices=split(devices, "|delim|")
|eval data=split(data, "|delim|")
|mvexpand devices
|spath input=devices "IP Address" output=ip
|spath input=devices "Component Type"
|spath input=devices "Operating System"
|spath input=data "System Acronym"
`is_server("Operating System", "Component Type", is_server)`
|search is_server="*"
|fields ip "Operating System" "Component Type"

]

Kindly upvote the answer, if found useful.
Happy Splunking!

View solution in original post

seemanshu
Path Finder

Hi @woodlandrelic ,

In the above shared search, you need to mention a common field among the  fields (ip "Operating System" "Component Type") in order to make the join work.
So, the updated search should look like, here i am assuming "ip" to be the common field for joining,

| inputlookup compliance_data_high_severity.csv

|join type=inner max=0 ip[
|inputlookup KononKV_system
|where isnotnull(devices)
|eval devices=split(devices, "|delim|")
|eval data=split(data, "|delim|")
|mvexpand devices
|spath input=devices "IP Address" output=ip
|spath input=devices "Component Type"
|spath input=devices "Operating System"
|spath input=data "System Acronym"
`is_server("Operating System", "Component Type", is_server)`
|search is_server="*"
|fields ip "Operating System" "Component Type"

]

Kindly upvote the answer, if found useful.
Happy Splunking!

woodlandrelic
Path Finder

@seemanshu 

Sorry for the late reply.  Your answer make so much sense helped my understanding better. Thank you again!

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...