https://community.splunk.com/t5/Getting-Data-In/How-to-join-a-DB-search-with-a-lookup-csv/m-p/365368#M66513 <P>I have a database search that pulls back a list of ID's for me and I also have a Lookup that has the titles and the IDs that relates to the DB ID's. For example, see the below:</P> <P>DB table has this ID: 123456<BR /> lookup csv has this title and ID: rhubarb and 123456</P> <P>The DB table has lots of other information in there which is why I need to join them to get more information and I can't find anything similar on Splunk. I have put my test query below but doesn't work so any advice is appreciated</P> <PRE><CODE>| dbxquery connection="gg" query="SELECT * from idstudio" | rename Id1 as Id2 | join Id1 [search lookup Idslookup.csv] </CODE></PRE> Tue, 20 Mar 2018 13:34:20 GMT Sfry1981 2018-03-20T13:34:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-join-a-DB-search-with-a-lookup-csv/m-p/365368#M66513 <P>I have a database search that pulls back a list of ID's for me and I also have a Lookup that has the titles and the IDs that relates to the DB ID's. For example, see the below:</P> <P>DB table has this ID: 123456<BR /> lookup csv has this title and ID: rhubarb and 123456</P> <P>The DB table has lots of other information in there which is why I need to join them to get more information and I can't find anything similar on Splunk. I have put my test query below but doesn't work so any advice is appreciated</P> <PRE><CODE>| dbxquery connection="gg" query="SELECT * from idstudio" | rename Id1 as Id2 | join Id1 [search lookup Idslookup.csv] </CODE></PRE> Tue, 20 Mar 2018 13:34:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-join-a-DB-search-with-a-lookup-csv/m-p/365368#M66513 Sfry1981 2018-03-20T13:34:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-join-a-DB-search-with-a-lookup-csv/m-p/365369#M66514 <P>You need to create a lookup definition on that csv lookup. For that follow this: <A href="http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/ConfigureCSVlookups">http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/ConfigureCSVlookups</A></P> <P>After you have created a lookup definition, let's say you named it ldslookup,</P> <PRE><CODE>| dbxquery connection="gg" query="SELECT * from idstudio" | lookup Id Idslookup OUTPUT &lt;whatever field you want form the lookup&gt; </CODE></PRE> Tue, 20 Mar 2018 13:41:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-join-a-DB-search-with-a-lookup-csv/m-p/365369#M66514 tiagofbmm 2018-03-20T13:41:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-join-a-DB-search-with-a-lookup-csv/m-p/365370#M66515 <P>Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that</P> Wed, 21 Mar 2018 17:29:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-join-a-DB-search-with-a-lookup-csv/m-p/365370#M66515 tiagofbmm 2018-03-21T17:29:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-join-a-DB-search-with-a-lookup-csv/m-p/365371#M66516 <P>Thanks for the response. I have done this but when i run the query it does not pull anything through from the lookup and only pulls through the db query. I currently have the below:</P> <P>| dbxquery connection="gg" query="SELECT * from idtable" | eval ParentId2=substr(ParentId , 1, len(ParentId )-3) <BR /> | lookup CommunityTitles2 KBID OUTPUT Title</P> <P>In your lookup you have the column name prior to the lookup which came back with an error message so i swapped it around. Any idea why it is not pulling anything back from the lookup table?</P> Wed, 21 Mar 2018 21:04:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-join-a-DB-search-with-a-lookup-csv/m-p/365371#M66516 Sfry1981 2018-03-21T21:04:29Z