https://community.splunk.com/t5/Splunk-Enterprise-Security/Merging-result-of-inputlookup-file-with-subsearch-to-get/m-p/379207#M3820 <P>i have one csv file which contains device name location data , i need to get count of all the device name location wise.<BR /> and then i am trying to get malware count and spyware count on the infected machines for one of indexed data as below but this search is not working "" Error in 'stats' command: The argument 'index=abc' is invalid"" if i remove inputlookup first line i will get results but i wont get total no of computers . how should i merge these two requirement . </P> <P>|inputlookup xyz.csv | stats count("Device Name") as Total_Computers by Location<BR /> index=abc | search TMCM:SLF_INCIDENT<BR /> |lookup xyz.csv "Device Name" as nodename OUTPUT Location<BR /> | stats count(nodename) as InfectedComputers count(signature) as MalwareCount <BR /> count(Spyware) as Spywarecount by Location<BR /> | table Total_Computers,Location,InfectedComputers, MalwareCount, Spywarecount </P> Tue, 29 Sep 2020 21:17:32 GMT SunilMaharishi 2020-09-29T21:17:32Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Merging-result-of-inputlookup-file-with-subsearch-to-get/m-p/379207#M3820 <P>i have one csv file which contains device name location data , i need to get count of all the device name location wise.<BR /> and then i am trying to get malware count and spyware count on the infected machines for one of indexed data as below but this search is not working "" Error in 'stats' command: The argument 'index=abc' is invalid"" if i remove inputlookup first line i will get results but i wont get total no of computers . how should i merge these two requirement . </P> <P>|inputlookup xyz.csv | stats count("Device Name") as Total_Computers by Location<BR /> index=abc | search TMCM:SLF_INCIDENT<BR /> |lookup xyz.csv "Device Name" as nodename OUTPUT Location<BR /> | stats count(nodename) as InfectedComputers count(signature) as MalwareCount <BR /> count(Spyware) as Spywarecount by Location<BR /> | table Total_Computers,Location,InfectedComputers, MalwareCount, Spywarecount </P> Tue, 29 Sep 2020 21:17:32 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Merging-result-of-inputlookup-file-with-subsearch-to-get/m-p/379207#M3820 SunilMaharishi 2020-09-29T21:17:32Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Merging-result-of-inputlookup-file-with-subsearch-to-get/m-p/379208#M3821 <P>hi @SunilMaharishi <BR /> try this</P> <PRE><CODE>|inputlookup xyz.csv | stats count("Device Name") as Total_Computers by Location|appendcols [search index=abc | search TMCM:SLF_INCIDENT |lookup xyz.csv "Device Name" as nodename OUTPUT Location | stats count(nodename) as InfectedComputers count(signature) as MalwareCount count(Spyware) as Spywarecount by Location ] | table Total_Computers,Location,InfectedComputers, MalwareCount, Spywarecount </CODE></PRE> Thu, 20 Sep 2018 12:07:48 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Merging-result-of-inputlookup-file-with-subsearch-to-get/m-p/379208#M3821 harishalipaka 2018-09-20T12:07:48Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Merging-result-of-inputlookup-file-with-subsearch-to-get/m-p/379209#M3822 <P>i tried using this , however i am getting the total computers and location but" InfectedComputers, MalwareCount, Spywarecount " is blank and not having any values</P> Thu, 20 Sep 2018 13:25:04 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Merging-result-of-inputlookup-file-with-subsearch-to-get/m-p/379209#M3822 SunilMaharishi 2018-09-20T13:25:04Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Merging-result-of-inputlookup-file-with-subsearch-to-get/m-p/379210#M3823 <P>i tried using append command and that is giving correct result , little bit modified the search though</P> Thu, 20 Sep 2018 13:25:37 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Merging-result-of-inputlookup-file-with-subsearch-to-get/m-p/379210#M3823 SunilMaharishi 2018-09-20T13:25:37Z