topic Re: How do I combine multiple lookups into one lookup? in Splunk Search

How do I combine multiple lookups into one lookup?

Glasses — Tue, 16 Feb 2021 19:03:43 GMT

Lets say I have 3 lookups >>> a-list.csv, b-list.csv, c-list.csv and the lists only have 1 column header = Name
Alice is on a-list
Bob is on b-list
Charles is on c-list

There are lots of people on each list and the lists are dynamic and updated.
I have a request to create a Combined_Master Lookup (where C_M-list.csv = a-list.csv + b-list.csv + c-list.csv),
where the list contains NAME, FLAG fields such as

NAME,FLAG

Alice, a-list
Bob, b-list
Charles, c-list

So far I use the following query to build the C_M-list.csv, where there is a Name and Flag appended to each name (which indicate which list the person is from)
BUT I am wondering if there is a better way...

My desired outcome is a M_C-list.csv

Alice,a-list

Bob,b-list

Charles,c-list

Any suggestions or improvements appreciated.
TY!

Re: How do I combine multiple lookups into one lookup?

Glasses — Wed, 17 Feb 2021 14:05:45 GMT

Is there a way to use "foreach" to add the flag and append?

Re: How do I combine multiple lookups into one lookup?

jacobpevans — Wed, 17 Feb 2021 15:23:37 GMT

Greetings @Glasses,

Try this:

Re: How do I combine multiple lookups into one lookup?

Glasses — Wed, 17 Feb 2021 15:38:12 GMT

@jacobpevans NICE!!!

I tried something similar with subsearches and failed... but this seems like they way to go.

Thank you!