topic Re: Filtering Lookup Results in Splunk Search

Filtering Lookup Results

aquinojason — Fri, 16 Apr 2021 14:00:40 GMT

Hi,

Below is a result of a lookup command, how do I exclude the other information if I based in on BusinessUnit, For ex. I want to show BU2 only... but there maybe cases that I need to show BU1 only. How can I filter my lookup result?

Application BusinessUnit DATE CALCMIPS

App1

App2

App3

App4

BU1

BU2

BU1

31DEC2020

My splunk query looks like

index=index1 sourcetype=source1 [ |inputlookup Application.csv where BusinessUnit = BU1 | return 1000 ACCOUNT_CODE] | lookup Application.csv ACCOUNT_CODE OUTPUT Application BusinessUnit ApplicationRTO | table Application BusinessUnit DATE MVS_SYSTEM_ID CALCMIPS

Thanks and Regards,

Re: Filtering Lookup Results

ericjorgensenjr — Fri, 16 Apr 2021 16:51:47 GMT

What are you trying to accomplish with this bit:

[ |inputlookup Application.csv where BusinessUnit = BU1 | return 1000 ACCOUNT_CODE]

Because it looks to me like there is no field 'ACCOUNT_CODE' in the lookup, so this is going to return null.

Also, based on the way you displayed the output of the lookup are the Application and Business Unit multivalue?

Lastly, I think it's not fully clear what you're trying to accomplish with the search, can you elaborate?

Re: Filtering Lookup Results

aquinojason — Fri, 16 Apr 2021 16:54:51 GMT

Hi,

Apologies if I didn't made myself clear but I was able to filter my lookup properly now after fixing my logic. Thanks!

Re: Filtering Lookup Results

richgalloway — Fri, 16 Apr 2021 18:29:34 GMT

Please share the fix and accept it as the solution to help future readers.

Re: Filtering Lookup Results

aquinojason — Fri, 16 Apr 2021 18:36:29 GMT

Hi,

I just included the BU as part of my lookup. That made it more distinct.

eval BusinessUnit = "BU1" | lookup Application.csv ACCOUNT_CODE BusinessUnit OUTPUT Application

Thanks and Regards,