https://community.splunk.com/t5/Splunk-Search/Do-two-joins-matching-inputlookup-data-to-build-table/m-p/355056#M105045 <P>I have a lookup - ips.csv - formated like...</P> <PRE><CODE>ip,name 1.2.3.4,server1 2.3.4.5,server2 </CODE></PRE> <P>My indexed data is source, destination. I want a table that is like...</P> <PRE><CODE>source, source_name, destination, destination_name </CODE></PRE> <P>Not all sources or destinations will have a name in the lookup, so I want to see all rows, even if there is no name...</P> <PRE><CODE>source, source_name, destination, destination_name 1.2.3.3,server,8.8.8.8,- 2.3.4.5,server2,4.4.4.4,client3 index=foo | table source destination | rename source AS ip | join [|inputlookup ips.csv | fields ip name] | rename ip AS source name AS source_name | rename destination AS ip | join [|inputlookup ips.csv | fields ip name] rename ip AS destination name AS destination_name | table source source_name destination destination_name </CODE></PRE> <P>Never seems to complete. I also get an error about renaming fields too many times.</P> <P>I've experimented with join, append, appendcols... with no luck. How can I build this table?</P> Thu, 15 Jun 2017 20:31:59 GMT yacht_rock 2017-06-15T20:31:59Z https://community.splunk.com/t5/Splunk-Search/Do-two-joins-matching-inputlookup-data-to-build-table/m-p/355056#M105045 <P>I have a lookup - ips.csv - formated like...</P> <PRE><CODE>ip,name 1.2.3.4,server1 2.3.4.5,server2 </CODE></PRE> <P>My indexed data is source, destination. I want a table that is like...</P> <PRE><CODE>source, source_name, destination, destination_name </CODE></PRE> <P>Not all sources or destinations will have a name in the lookup, so I want to see all rows, even if there is no name...</P> <PRE><CODE>source, source_name, destination, destination_name 1.2.3.3,server,8.8.8.8,- 2.3.4.5,server2,4.4.4.4,client3 index=foo | table source destination | rename source AS ip | join [|inputlookup ips.csv | fields ip name] | rename ip AS source name AS source_name | rename destination AS ip | join [|inputlookup ips.csv | fields ip name] rename ip AS destination name AS destination_name | table source source_name destination destination_name </CODE></PRE> <P>Never seems to complete. I also get an error about renaming fields too many times.</P> <P>I've experimented with join, append, appendcols... with no luck. How can I build this table?</P> Thu, 15 Jun 2017 20:31:59 GMT https://community.splunk.com/t5/Splunk-Search/Do-two-joins-matching-inputlookup-data-to-build-table/m-p/355056#M105045 yacht_rock 2017-06-15T20:31:59Z https://community.splunk.com/t5/Splunk-Search/Do-two-joins-matching-inputlookup-data-to-build-table/m-p/355057#M105046 <P>Like this:</P> <PRE><CODE>index=foo | dedup source destination | table source destination | lookup jps.csv ip AS source OUTPUT name AS source_name | lookup jps.csv ip AS destination OUTPUT name AS destination_name </CODE></PRE> Thu, 15 Jun 2017 21:30:44 GMT https://community.splunk.com/t5/Splunk-Search/Do-two-joins-matching-inputlookup-data-to-build-table/m-p/355057#M105046 woodcock 2017-06-15T21:30:44Z