Splunk Search

why can't I use join to return all suited value?

pingpangbubai
Explorer

hi, all:
I want to link the two parts.The first is a csv file, the second is an index. The fileld name that i want to link is called "hash value", the search method I used is like that:

| inputcsv 201501 | eval HASH=hash | join HASH [search index="license" | rename HASH as hashkey | makemv delim=";" num | makemv delim=";" hashkey | eval fields = mvzip(num, hashkey) | mvexpand fields | rex field=fields "(?<alpha>.*),(?<beta>.*)" | rename alpha as num beta as HASH | dedup HASH] | table HASH

Unfortunately, from 3000 entries I had joined 2800, Some of the data in the two hundred could also be searched in the index "license", but not join successfully. And the HASH filed is multi-value in "license", I had expanded it. Why can't join command lind all suitable value? 
Could you give me some ideas, I've throught all the daytime, Thanks to all !  
0 Karma

lguinn2
Legend

If you set up your CSV file as a lookup table, this would be so much easier!! Setup a lookup and be sure to set a default value of "not found" to indicate if the lookup fails to find the key. Then this search will work:

 index="license" 
| rename HASH as hashkey 
| makemv delim=";" num 
| makemv delim=";" hashkey 
| eval fields = mvzip(num, hashkey) 
| mvexpand fields 
| rex field=fields "(?<alpha>.*),(?<beta>.*)" 
| rename alpha as num beta as HASH 
| dedup HASH
| lookup yourLookupTable HASH OUTPUT result
| table HASH
| where result!="not found"

This will work, even if you have a huge number of entries in the CSV file. If you have a smaller number, then you can do this

index="license" [ inputcsv 201501 ]
 | rename HASH as hashkey 
 | makemv delim=";" num 
 | makemv delim=";" hashkey 
 | eval fields = mvzip(num, hashkey) 
 | mvexpand fields 
 | rex field=fields "(?<alpha>.*),(?<beta>.*)" 
 | rename alpha as num beta as HASH 
 | dedup HASH
 | table HASH
0 Karma

pingpangbubai
Explorer

Hi, is there no need to use join again?

0 Karma

pingpangbubai
Explorer

And what's the reason of my problem?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...