topic lookup multi value in Splunk Search

lookup multi value

ChetanArgekar — Sat, 19 Sep 2020 10:49:08 GMT

I have multiple devices in a given location maintaining it lookup table with location and device.

Using location from index I am trying to get device list but output is coming in single row. I want list of devices as separate row. How to achieve it.

My query is like this

index =myindex

| lookup mylookup location OUTPUT devices

| table devices

Re: lookup multi value

gcusello — Sat, 19 Sep 2020 10:57:11 GMT

Hi @ChetanArgekar,

please, try something like this:

Ciao.

Giuseppe

Re: lookup multi value

ChetanArgekar — Sat, 19 Sep 2020 11:13:10 GMT

thanks

It is giving only one device of location. I want list of every device of the location in separate row

Re: lookup multi value

ChetanArgekar — Sat, 19 Sep 2020 11:24:45 GMT

Solved.

index = myindex

| lookup mylookup location OUTPUT devices

| stats count(devices) by location, devices

| table devices