Lookup from multiple table

basics — Sun, 08 Nov 2020 07:18:27 GMT

Hello,

my goal is to find and combine data from multiple source.

Here:

employee_lookup: the table for all employee database
product_lookup: the table for all the product

now my goal is to find, how many company wide product each department uses and group by DepartmentName, ProductName, and Count.

The department name is on the "employee_lookup" table along with employee name, department name. So when any employee clicks on a product, it is counted as a product use and logs the data into Splunk.

my Splunk query is as follows:

data = "global"
| lookup product_lookup productID OUTPUT ProductName
| lookup employee_lookup userID OUTPUT DepartmentName
| table ProductName, DepartmentName, UserID

that query does not work...

My goal is to find the total count of product usages by Department.

The resulting table should be like:

DepartmentName, Product, count
--------------------------------------------------
Dept_5, Product1234, 2000
Dept_5, Product333, 1434
Dept_5, Product633, 600
Dept_2, Product333, 2500
Dept_2, Product215, 2500
Dept_2, Product415, 1200
....

so basically group by department, product, count

any suggestions and recommendation would be very helpful. Thank you!

Re: Lookup from multiple table

to4kawa — Sun, 08 Nov 2020 08:31:04 GMT

If your log has both productID and userID field, your query will run.
If there aren't these, you should provide more details.

Re: Lookup from multiple table

basics — Sun, 08 Nov 2020 08:53:23 GMT

I had a typo and it works now.

However, couple more questions because I cannot do:

Group by DepartmentName, ProductName, Count

how do I do that?

Re: Lookup from multiple table

to4kawa — Sun, 08 Nov 2020 09:11:13 GMT

your query

| stats count by DepartmentName, ProductName

topic Re: Lookup from multiple table in Splunk Search

Lookup from multiple table

Re: Lookup from multiple table

Re: Lookup from multiple table

Re: Lookup from multiple table