https://community.splunk.com/t5/Splunk-Enterprise/How-to-combine-indexed-data-with-an-inputlookup-csv-file/m-p/424033#M7671 <P>How have you uploaded your historical CSV data, as a lookup table file OR indexed data? If it's lookup table file and has less than 10k records, you can append the CSV result to your indexed data search using <CODE>append</CODE> command.</P> Wed, 30 May 2018 16:29:19 GMT somesoni2 2018-05-30T16:29:19Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-combine-indexed-data-with-an-inputlookup-csv-file/m-p/424032#M7670 <P>Hello, </P> <P>I have uploaded several csv files into Splunk that contain historical data values for storage usage over time. I would like to combine the csv data with more recent data that is currently being indexed in Splunk going back to only 6 months. I would like to combine the historical 2 years worth of data on the csv files with the 6 months that Splunk is indexing, and use this combined search to begin building a predictive model with 2.5 years worth of storage usage/total size over time. Any help is appreciated, thanks! </P> Wed, 30 May 2018 15:58:16 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-combine-indexed-data-with-an-inputlookup-csv-file/m-p/424032#M7670 pred312 2018-05-30T15:58:16Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-combine-indexed-data-with-an-inputlookup-csv-file/m-p/424033#M7671 <P>How have you uploaded your historical CSV data, as a lookup table file OR indexed data? If it's lookup table file and has less than 10k records, you can append the CSV result to your indexed data search using <CODE>append</CODE> command.</P> Wed, 30 May 2018 16:29:19 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-combine-indexed-data-with-an-inputlookup-csv-file/m-p/424033#M7671 somesoni2 2018-05-30T16:29:19Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-combine-indexed-data-with-an-inputlookup-csv-file/m-p/424034#M7672 <P>As written in somesoni2's comment, something like this should do the trick:</P> <PRE><CODE>|inputlookup &lt;yourlookuptable&gt; | append [search index=&lt;nameoftheindexcontainingthelast6monthdata&gt; ...] </CODE></PRE> <P>Also refer to: <A href="https://docs.splunk.com/Documentation/SplunkCloud/7.0.3/SearchReference/Append">https://docs.splunk.com/Documentation/SplunkCloud/7.0.3/SearchReference/Append</A></P> Thu, 31 May 2018 14:19:51 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-combine-indexed-data-with-an-inputlookup-csv-file/m-p/424034#M7672 poete 2018-05-31T14:19:51Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-combine-indexed-data-with-an-inputlookup-csv-file/m-p/424035#M7673 <P>And based on which search (inputlookup or your indexed data search) has higher number of records, that one should be run as subsearch. </P> Thu, 31 May 2018 15:06:59 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-combine-indexed-data-with-an-inputlookup-csv-file/m-p/424035#M7673 somesoni2 2018-05-31T15:06:59Z