topic data validation Lookups in Splunk Search https://community.splunk.com/t5/Splunk-Search/data-validation-Lookups/m-p/404610#M195974 <P>Hi Team,<BR /> I am new to splunk. and need help in validating data in a lookup</P> <P>I have lookup and the data is like below</P> <P>ci_list_lookup</P> <P>sys_id name class_name<BR /> <STRONG>xyz</STRONG> Anil H<BR /> <STRONG>abc</STRONG> Anthony B<BR /> def <STRONG>abc</STRONG> ci<BR /> lmn nirav H<BR /> pqr <STRONG>xyz</STRONG> ci</P> <P>Here the name column contains sys_id values. which I dont want</P> <P>I want to create a lookup which looks like below</P> <P>sys_id name class_name<BR /> xyz Anil H<BR /> abc Anthony B<BR /> def Anthony ci<BR /> lmn nirav H<BR /> pqr Anil ci</P> <P>I tried using joins, Self joins but didn't work.</P> <P>Please help me in getting the above output</P> Tue, 29 Sep 2020 20:53:18 GMT kumar88 2020-09-29T20:53:18Z data validation Lookups https://community.splunk.com/t5/Splunk-Search/data-validation-Lookups/m-p/404610#M195974 <P>Hi Team,<BR /> I am new to splunk. and need help in validating data in a lookup</P> <P>I have lookup and the data is like below</P> <P>ci_list_lookup</P> <P>sys_id name class_name<BR /> <STRONG>xyz</STRONG> Anil H<BR /> <STRONG>abc</STRONG> Anthony B<BR /> def <STRONG>abc</STRONG> ci<BR /> lmn nirav H<BR /> pqr <STRONG>xyz</STRONG> ci</P> <P>Here the name column contains sys_id values. which I dont want</P> <P>I want to create a lookup which looks like below</P> <P>sys_id name class_name<BR /> xyz Anil H<BR /> abc Anthony B<BR /> def Anthony ci<BR /> lmn nirav H<BR /> pqr Anil ci</P> <P>I tried using joins, Self joins but didn't work.</P> <P>Please help me in getting the above output</P> Tue, 29 Sep 2020 20:53:18 GMT https://community.splunk.com/t5/Splunk-Search/data-validation-Lookups/m-p/404610#M195974 kumar88 2020-09-29T20:53:18Z