hi, all:
I want to link the two parts.The first is a csv file, the second is an index. The fileld name that i want to link is called "hash value", the search method I used is like that:
| inputcsv 201501 | eval HASH=hash | join HASH [search index="license" | rename HASH as hashkey | makemv delim=";" num | makemv delim=";" hashkey | eval fields = mvzip(num, hashkey) | mvexpand fields | rex field=fields "(?<alpha>.*),(?<beta>.*)" | rename alpha as num beta as HASH | dedup HASH] | table HASH
Unfortunately, from 3000 entries I had joined 2800, Some of the data in the two hundred could also be searched in the index "license", but not join successfully. And the HASH filed is multi-value in "license", I had expanded it. Why can't join command lind all suitable value?
Could you give me some ideas, I've throught all the daytime, Thanks to all !
If you set up your CSV file as a lookup table, this would be so much easier!! Setup a lookup and be sure to set a default value of "not found" to indicate if the lookup fails to find the key. Then this search will work:
index="license"
| rename HASH as hashkey
| makemv delim=";" num
| makemv delim=";" hashkey
| eval fields = mvzip(num, hashkey)
| mvexpand fields
| rex field=fields "(?<alpha>.*),(?<beta>.*)"
| rename alpha as num beta as HASH
| dedup HASH
| lookup yourLookupTable HASH OUTPUT result
| table HASH
| where result!="not found"
This will work, even if you have a huge number of entries in the CSV file. If you have a smaller number, then you can do this
index="license" [ inputcsv 201501 ]
| rename HASH as hashkey
| makemv delim=";" num
| makemv delim=";" hashkey
| eval fields = mvzip(num, hashkey)
| mvexpand fields
| rex field=fields "(?<alpha>.*),(?<beta>.*)"
| rename alpha as num beta as HASH
| dedup HASH
| table HASH
Hi, is there no need to use join again?
And what's the reason of my problem?