KQL - join condition issue

Question

Hello,

I'm trying to enrich the logs coming from Oracle in Sentinel for a customer. It seems that the only unique field from the OracleDatabaseAuditEvent table is DbId and this is what I'll use.
The way to enrich the events from the Oracle feed is to match the DbId column(which seems to be unique for Oracle) of the OracleDatabaseAuditEvent table in Sentinel with a watchlist containing more information for each database. Where there are matches between thewatchlist and the table in Sentinel these events are enriched, if there's no match Sentinel returns just the record of OracleDatabaseAuditEvent table.
Unfortunately that is not the case, because the watchlist(list sent from the Oracle team) contains names of databases with duplicate DbId in some rows.

Oracle events for the last hour:

I use leftouter to keep the results of the OracleDatabaseAuditEvent even if the join condition doesn't find any matching record from the watchlist:

My questions are:

1. Why do I get more logs count after joining the tables? If i'm doing everything the right way it seems I should be getting the same exact count of events(or close). I assume Sentinel produces more records, because of the duplication in the DbId column from the watchlist?
2. I came upon this - https://dba.stackexchange.com/questions/178129/oracle-dbid-what-is-logic-to-create-oracle-dbid - Does this mean that the Oracle team have copies of their DBs and this is why there are duplicate DbId s?
3. How do I enrich the events then if that's not the case?

Answer 1

Hi ppal,
It's likely left joins don't work the way you expect.
As you can see in this example, null matches may be getting returned.
Try your query w/o the summarization to see.
joinoperator