Splunk Search

why can't I use join to return all suited value?

pingpangbubai
Explorer

hi, all:
I want to link the two parts.The first is a csv file, the second is an index. The fileld name that i want to link is called "hash value", the search method I used is like that:

| inputcsv 201501 | eval HASH=hash | join HASH [search index="license" | rename HASH as hashkey | makemv delim=";" num | makemv delim=";" hashkey | eval fields = mvzip(num, hashkey) | mvexpand fields | rex field=fields "(?<alpha>.*),(?<beta>.*)" | rename alpha as num beta as HASH | dedup HASH] | table HASH

Unfortunately, from 3000 entries I had joined 2800, Some of the data in the two hundred could also be searched in the index "license", but not join successfully. And the HASH filed is multi-value in "license", I had expanded it. Why can't join command lind all suitable value? 
Could you give me some ideas, I've throught all the daytime, Thanks to all !  
0 Karma

lguinn2
Legend

If you set up your CSV file as a lookup table, this would be so much easier!! Setup a lookup and be sure to set a default value of "not found" to indicate if the lookup fails to find the key. Then this search will work:

 index="license" 
| rename HASH as hashkey 
| makemv delim=";" num 
| makemv delim=";" hashkey 
| eval fields = mvzip(num, hashkey) 
| mvexpand fields 
| rex field=fields "(?<alpha>.*),(?<beta>.*)" 
| rename alpha as num beta as HASH 
| dedup HASH
| lookup yourLookupTable HASH OUTPUT result
| table HASH
| where result!="not found"

This will work, even if you have a huge number of entries in the CSV file. If you have a smaller number, then you can do this

index="license" [ inputcsv 201501 ]
 | rename HASH as hashkey 
 | makemv delim=";" num 
 | makemv delim=";" hashkey 
 | eval fields = mvzip(num, hashkey) 
 | mvexpand fields 
 | rex field=fields "(?<alpha>.*),(?<beta>.*)" 
 | rename alpha as num beta as HASH 
 | dedup HASH
 | table HASH
0 Karma

pingpangbubai
Explorer

Hi, is there no need to use join again?

0 Karma

pingpangbubai
Explorer

And what's the reason of my problem?

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...