topic Re: Can I use lookup instead of join? in Splunk Search

Can I use lookup instead of join?

LxSenpai — Thu, 21 Jun 2018 13:58:43 GMT

Hello guys
So I have a table where there are Index and Role. In another table, there is Index and Description. So what I am trying to output is something like this below:-

Role | Index | Description
1       | a_2 | World says hello back.
          |a_3| Hello 
2      |a_4| WOW

Currently using join the index fields are being joined. But is there a way to do the joining without Join but only lookup?

|mvexpand Indexes
|fields Index2, Indexes, Role

|join type=outer Indexes [ inputlookup index_info_lu | rename Index as Indexes]  << here>>

| stats list(Indexes) as Indexes,list(Description) as Description by Role

Re: Can I use lookup instead of join?

somesoni2 — Thu, 21 Jun 2018 15:39:01 GMT

Give this a try

your base search
|mvexpand Indexes
|fields Indexes, Role
| lookup index_info_lu Index as Indexes OUTPUT Description
| stats list(Indexes) as Indexes,list(Description) as Description by Role

Re: Can I use lookup instead of join?

LxSenpai — Thu, 21 Jun 2018 15:59:04 GMT

Thanks alot