https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-two-files-get-the-data/m-p/354150#M104817 <P>Hi,</P> <P>I have two input lookup files. input1.csv and input2.csv</P> <P>Am getting "Maintenance for application" as value for say one of the columns from input1.csv file. <BR /> Now I want to search word <EM>application</EM> in input2.csv file and try to get field1 and field2 from input2.csv file along with field3 and field4 from input1.csv file. <BR /> Please help me with the query. </P> Tue, 07 Nov 2017 15:42:20 GMT surekhasplunk 2017-11-07T15:42:20Z https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-two-files-get-the-data/m-p/354150#M104817 <P>Hi,</P> <P>I have two input lookup files. input1.csv and input2.csv</P> <P>Am getting "Maintenance for application" as value for say one of the columns from input1.csv file. <BR /> Now I want to search word <EM>application</EM> in input2.csv file and try to get field1 and field2 from input2.csv file along with field3 and field4 from input1.csv file. <BR /> Please help me with the query. </P> Tue, 07 Nov 2017 15:42:20 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-two-files-get-the-data/m-p/354150#M104817 surekhasplunk 2017-11-07T15:42:20Z https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-two-files-get-the-data/m-p/354151#M104818 <P>Assuming input1.csv has following columns (apart from other possible columns)</P> <PRE><CODE>app_description (which contains the text "Maintenance for **application**" field3 field4 </CODE></PRE> <P>What's the column name in input2.csv which contains word <STRONG>application</STRONG>? Also, is it a full match OR partial match?</P> Tue, 07 Nov 2017 16:36:31 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-two-files-get-the-data/m-p/354151#M104818 somesoni2 2017-11-07T16:36:31Z https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-two-files-get-the-data/m-p/354152#M104819 <P>Hi @somesoni2</P> <P>Assume input2.csv file has a column named app_name which has got a match for application and not the exact name. </P> Wed, 08 Nov 2017 09:30:11 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-two-files-get-the-data/m-p/354152#M104819 surekhasplunk 2017-11-08T09:30:11Z https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-two-files-get-the-data/m-p/354153#M104820 <P>You can try this .. if you are working on the same use case..</P> <P><A href="https://answers.splunk.com/answers/589532/lookup-two-csv-pattern-match-query.html">https://answers.splunk.com/answers/589532/lookup-two-csv-pattern-match-query.html</A></P> <P>| inputlookup input1 | join type=outer field1 [| inputlookup input2 | eval field1=case(field3 == "application file", "application support", field3 == "cto maintenance", "technology maintenance") | search field3="application*" | rename field2 as field21 ] | table field1, field2, field21, field3</P> <P>if possible avoid same field name in your two input csv files. or you can rename that at the query time.. </P> Fri, 10 Nov 2017 07:33:27 GMT https://community.splunk.com/t5/Splunk-Search/inputlookup-csv-two-files-get-the-data/m-p/354153#M104820 anjambha 2017-11-10T07:33:27Z