topic Need help to combine inputlookup and map search for two sources in Splunk Search

Need help to combine inputlookup and map search for two sources

kiragsplunk — Tue, 14 Jul 2020 16:27:10 GMT

Team,

Need help to build a dashboard .

WH.csv content

XXX

YYY

I want to search in two different sources but wanna use the same variable from inputlookup variable.

existing Query

Issue : second search is not getting the variable $ware_house$ so it does not return any result.

As soon as the base search work would like to add it in the Dashboard.

Re: Need help to combine inputlookup and map search for two sources

richgalloway — Tue, 14 Jul 2020 18:26:30 GMT

How did you verify the token is not getting passed into the map command?

Have you tried using the concatenation operator?

Also, I think the subsearch to appendcols won't work. The second stats command is trying to add up a multi-value field, which it probably won't do.

Re: Need help to combine inputlookup and map search for two sources

kiragsplunk — Tue, 14 Jul 2020 20:00:31 GMT

Thanks Rich,

Could you please recommend any search string to accomplish this. as you said appendcols not working in map. if I manually assign value (XXX_WH_OVERVIEW & XXX_WH_SHIPPING) works fine. whats the best approach do you recommend?

Re: Need help to combine inputlookup and map search for two sources

kiragsplunk — Tue, 14 Jul 2020 20:12:33 GMT

I ran the query manually to validate the second string.. it would be great if I get this fixed in search..

Re: Need help to combine inputlookup and map search for two sources

richgalloway — Tue, 14 Jul 2020 20:58:18 GMT

Let's break the query up, get the pieces working, then put them together. Do these two searches produce the expected results?

Re: Need help to combine inputlookup and map search for two sources

kiragsplunk — Wed, 15 Jul 2020 15:06:49 GMT

I am getting expected results in both search, could you please help me to append it, if I append the results I am getting time range Error and no results found.

Re: Need help to combine inputlookup and map search for two sources

richgalloway — Wed, 15 Jul 2020 16:53:40 GMT

We've verified each subsearch works. Good.
Now the problem is how to combine them. To correlate the events from each subsearch, there must be something in common between them. I see no commonality, but I'm not familiar with the data. Do the subsearches share a field?

Re: Need help to combine inputlookup and map search for two sources

kiragsplunk — Wed, 15 Jul 2020 20:54:32 GMT

No common in between.. those are two different sources from the same index. I don't see any common field in between both search. ( except the index)

Re: Need help to combine inputlookup and map search for two sources

richgalloway — Thu, 16 Jul 2020 00:25:49 GMT

That's a big stumbling block. The lack of something in common means Splunk has nothing to use to pair up events from each search.

Re: Need help to combine inputlookup and map search for two sources

kiragsplunk — Thu, 16 Jul 2020 13:10:52 GMT

May I use a python script to run each query separately then combine the results to a csv .

that results can be viewed is Dashboard right? Please advise.

Re: Need help to combine inputlookup and map search for two sources

richgalloway — Thu, 16 Jul 2020 14:33:12 GMT

I'm not sure how a python script would merge the results, but I suppose it's possible. The resulting CSV file could then be displayed by a dashboard.