https://community.splunk.com/t5/Splunk-Search/How-to-join-events-with-lookuptable-based-on-numerical-values/m-p/339918#M100805 <P>I want to join these two types of data: </P> <OL> <LI><P>The following events have the recorded value for each step in a test.</P> <PRE><CODE>TestNum StepNum recordedValue </CODE></PRE> <P>AFKE-232322 501 32.254 <BR /> AFKE-232322 508 1.0223 <BR /> AFKE-232322 842 1.0582 <BR /> AFKE-232322 805 -24.25 <BR /> AFKE-232322 503 22.0 <BR /> AFKE-232322 504 100.05<BR /> The following table (lookuptable) has the instrument name used on each block of the test. (A test has multiple blocks, each block has multiple steps, and each block use an instrument.) The Instrument field has string values like "DMM_23s3".</P> <P>TestNum Block InstrumentUsed<BR /> AFKE-232322 100 inst_1<BR /> AFKE-232322 200 inst_2<BR /> AFKE-232322 300 inst_3<BR /> AFKE-232322 400 inst_4<BR /> At the end, I would like to have something like this:</P> <P>TestNum StepNum recordedValue Instrument<BR /> AFKE-232322 501 32.254 Inst_5<BR /> AFKE-232322 508 1.0223 inst_5<BR /> AFKE-232322 842 1.0582 inst_8<BR /> AFKE-232322 805 -24.25 inst_8<BR /> AFKE-232322 503 22.0 inst_5<BR /> AFKE-232322 504 100.05 ints_5<BR /> Note that the block number is always the first step on the block and it could be any positive integer. To find the block of a step, I need to look for the two blocks before and after a step. </P></LI> </OL> <P>Examples of blocks and their steps:<BR /> Block 502 { 503, 504, 550, ... ,634}<BR /> Block 650 { 651, 652, 653}<BR /> Block 655 { 656, 657, 658}</P> <P>step 634 is part of block 502<BR /> step 652 is part of Block 650<BR /> step 657 is part of Block 655</P> Tue, 29 Sep 2020 18:22:33 GMT edrivera3 2020-09-29T18:22:33Z https://community.splunk.com/t5/Splunk-Search/How-to-join-events-with-lookuptable-based-on-numerical-values/m-p/339918#M100805 <P>I want to join these two types of data: </P> <OL> <LI><P>The following events have the recorded value for each step in a test.</P> <PRE><CODE>TestNum StepNum recordedValue </CODE></PRE> <P>AFKE-232322 501 32.254 <BR /> AFKE-232322 508 1.0223 <BR /> AFKE-232322 842 1.0582 <BR /> AFKE-232322 805 -24.25 <BR /> AFKE-232322 503 22.0 <BR /> AFKE-232322 504 100.05<BR /> The following table (lookuptable) has the instrument name used on each block of the test. (A test has multiple blocks, each block has multiple steps, and each block use an instrument.) The Instrument field has string values like "DMM_23s3".</P> <P>TestNum Block InstrumentUsed<BR /> AFKE-232322 100 inst_1<BR /> AFKE-232322 200 inst_2<BR /> AFKE-232322 300 inst_3<BR /> AFKE-232322 400 inst_4<BR /> At the end, I would like to have something like this:</P> <P>TestNum StepNum recordedValue Instrument<BR /> AFKE-232322 501 32.254 Inst_5<BR /> AFKE-232322 508 1.0223 inst_5<BR /> AFKE-232322 842 1.0582 inst_8<BR /> AFKE-232322 805 -24.25 inst_8<BR /> AFKE-232322 503 22.0 inst_5<BR /> AFKE-232322 504 100.05 ints_5<BR /> Note that the block number is always the first step on the block and it could be any positive integer. To find the block of a step, I need to look for the two blocks before and after a step. </P></LI> </OL> <P>Examples of blocks and their steps:<BR /> Block 502 { 503, 504, 550, ... ,634}<BR /> Block 650 { 651, 652, 653}<BR /> Block 655 { 656, 657, 658}</P> <P>step 634 is part of block 502<BR /> step 652 is part of Block 650<BR /> step 657 is part of Block 655</P> Tue, 29 Sep 2020 18:22:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-events-with-lookuptable-based-on-numerical-values/m-p/339918#M100805 edrivera3 2020-09-29T18:22:33Z