topic Re: Match values under 2 different fields in Splunk Search

Match values under 2 different fields

linwqg — Tue, 13 Mar 2018 12:17:55 GMT

Need help. Appreciate in advance.

I have 2 lookup csv. I need to match each value under "numberX" field against the list of values under "numnberY" field. If there is a match, e.g. 4653, to obtain the following output.

Re: Match values under 2 different fields

p_gurav — Tue, 13 Mar 2018 13:10:53 GMT

Hi,

try something like this:

|inputlookup csv2|lookup csv1 numberX AS numberY OUTPUTNEW info,more_info|table numberX, info, more_info

Re: Match values under 2 different fields

linwqg — Wed, 14 Mar 2018 02:02:21 GMT

Thanks for the headstart.

Tried but it does not seem to work.

Re: Match values under 2 different fields

HiroshiSatoh — Wed, 14 Mar 2018 06:32:01 GMT

Try this!

|inputlookup csv1|search [search |inputlookup csv2|rename numberY AS numberX |table numberX ]
|table numberX, info, more_info
OR
|inputlookup csv1|join type=inner numberX AS numberY [search |inputlookup csv2]
|table numberX, info, more_info

Re: Match values under 2 different fields

linwqg — Wed, 14 Mar 2018 11:32:52 GMT

Many thanks. Will definitely give this a try as well.

Re: Match values under 2 different fields

linwqg — Wed, 14 Mar 2018 11:33:57 GMT

I did abit of cleanup and i think it works. Thanks p_gurav.

Re: Match values under 2 different fields

linwqg — Wed, 14 Mar 2018 11:47:19 GMT

I understand from the first pipe onward, that we are renaming the field and table it out.

Why is this important? How to interpret the search before all these?

search |inputlookup csv2|rename numberY AS numberX |table numberX

Re: Match values under 2 different fields

niketn — Wed, 14 Mar 2018 12:03:15 GMT

@linwqg, try the following search

| inputlookup csv1.csv where 
    [| inputlookup csv2.csv 
    | rename numberY as numberX 
    | table numberX]

Re: Match values under 2 different fields

HiroshiSatoh — Wed, 14 Mar 2018 14:43:22 GMT

|search [search |inputlookup csv2|rename numberY AS numberX |table numberX]
↓
search (numberX="X" OR numberX="Y" OR numberX="Z")

Re: Match values under 2 different fields

linwqg — Wed, 14 Mar 2018 16:15:07 GMT

Thanks niketnilay. Will give it a try too.

Re: Match values under 2 different fields

linwqg — Wed, 14 Mar 2018 16:21:01 GMT

What's the different between 1 and 2?

|inputlookup csv1|search [search |inputlookup csv2|rename numberY AS numberX |table numberX ]
|inputlookup csv1|search [|inputlookup csv2|rename numberY AS numberX |table numberX ]

Re: Match values under 2 different fields

linwqg — Thu, 15 Mar 2018 14:04:04 GMT

Your approach work as well. Thanks niketnilay.

Re: Match values under 2 different fields

niketn — Thu, 15 Mar 2018 16:36:47 GMT

@linwqg, please accept the answer if your issue is resolved to mark this question as answered 🙂