topic Re: Why are two of my columns empty in a table returned by a lookup file with multiple fields? in Splunk Search

Why are two of my columns empty in a table returned by a lookup file with multiple fields?

faribole — Thu, 13 Sep 2018 13:17:39 GMT

I used a lookup file which is configuring like this

field1, field2, field3, field4
value1, value2, value3, value4
value10, value2, value3, value4
value11, value2, value3, value4

I would like to obtain the results in a table where i count the quantity of the first field.

field2    field3      field4      field1
value2   value3    value4    3

I tried this search:

my search | lookup mylookup field1 output field2, field3, field4 | chart count by field2 | table field2 field3 field4 nb

but columns field3 and field 4 are empty
where is my mistake ?

somesoni2 — Thu, 13 Sep 2018 16:19:32 GMT

Give this a try

my search | lookup mylookup field1 output field2, field3, field4 | stats count by field2 field3 field4

faribole — Mon, 17 Sep 2018 08:44:04 GMT

Thanks it's ok