topic How to link two different CSVs that have one column in common? in Dashboards & Visualizations

How to link two different CSVs that have one column in common?

mah — Mon, 24 Aug 2020 22:12:52 GMT

Hi,

My issue is :

I want to link 2 different CSVs that have 1 column in common.

My first csv :

account	id	year	month	total
aaa	111	2020	jan	445

My second csv :

account_num	platform
111	zzz

The values of the header id in the first CSV corresponding to th value of account_num in the second CSV.

What I want is to link both csv with the id/account_num so that platform values (2nd csv) match to the right account (1st csv).

Is there a way to do this?

Thanks !

Re: how to append a column in one csv to a search calls an other csv ?

to4kawa — Tue, 25 Aug 2020 10:21:29 GMT

Re: how to append a column in one csv to a search calls an other csv ?

mah — Mon, 24 Aug 2020 12:58:34 GMT

OK thanks it correctly add at the end the end column platform !

Now, I want to create a request which gives me the following table :

platform	account	jan	feb	mars	...	Total
A	aaa
A	bbb
B	ccc
B	ddd

I created a request that gave me a part of the solution :

| inputlookup append=t first_csv.csv
| lookup second_csv.csv account_number as id OUTPUT platform
| search Year="2020"
| search account=*
| chart sum(Total) by account, Month useother=false
| addtotals
| table account,Jan,Feb,Mar,Apr,May,Jun,Jul,Aug,Total

but how can I append the column platform like the table I want ? is it possible ?

Re: how to append a column in one csv to a search calls an other csv ?

to4kawa — Tue, 25 Aug 2020 10:21:50 GMT

Re: how to append a column in one csv to a search calls an other csv ?

mah — Mon, 24 Aug 2020 13:17:15 GMT

Sorry I think you made a mistake in your answer because I already did that.

What I want is at the end a table like that :

| table platform, account, janv,feb,...,Total

Re: how to append a column in one csv to a search calls an other csv ?

mah — Mon, 24 Aug 2020 14:28:44 GMT

I have already tried that query, and it returns empty cells because the

| chart ...

makes a filter on account, month, Total so that it is impossible to have "platform" at the end in the
| table ....

Re: how to append a column in one csv to a search calls an other csv ?

to4kawa — Tue, 25 Aug 2020 10:22:10 GMT

Re: how to append a column in one csv to a search calls an other csv ?

mah — Tue, 25 Aug 2020 07:36:32 GMT

I think it is the chart command that filtering the result on fields account, month and total.

account	jan	feb	mar	total
c	1	4	7	12
d	2	5	8	15
e	3	6	9	18

And after this command, even if I call the fields platform in the table command I will never have the values of that field because of the chart filtering.

Let me know if I am wrong.

I am looking for a solution where I can add platform column after the chart in order to have this table :

platform	account	jan	feb	mar	total
A	c	1	4	7	12
A	d	2	5	8	15
B	e	3	6	9	18

Re: how to append a column in one csv to a search calls an other csv ?

to4kawa — Tue, 25 Aug 2020 10:22:29 GMT

Re: how to append a column in one csv to a search calls an other csv ?

mah — Tue, 25 Aug 2020 08:39:31 GMT

Sorry for our misunderstanding and if I express myself badly.

Your solution works great !

Thanks a lot for your help.

Re: how to append a column in one csv to a search calls an other csv ?

to4kawa — Tue, 25 Aug 2020 10:19:51 GMT

Terrible.
That's the result of the new Splunk Answers, right?
I hope we don't have any more of these people around.

He didn't provide accurate information.
He changes what he says with every word he says.
No explanation of what was resolved.