topic Re: Join results from two lookups in Splunk Search

Join results from two lookups

shaquibk — Thu, 16 Sep 2021 06:54:45 GMT

My requirement is something like this:

Lookup 1 looks like this

Name | Avg_Count
A | 3
B | 7
D | 8
F | 5

Lookup 2 looks like this:

Name | Current_Count
A | 2
C | 4
D | 6

In the search, I input both these lookups and want results like this:
Name | Avg_Count | Current_count
A | 3 | 2
B | 7 | 0/null (0 preferred)
D | 8 | 6
F | 5 | 0
C | 0 | 4

I have tried join/append/appendcols but all these have their limitations and won't give the intended results. Also looked at many solutions from community but couldn't find one.

Thanks in advance!

Shaquib

Re: Join results from two lookups

ITWhisperer — Thu, 16 Sep 2021 08:57:58 GMT

Re: Join results from two lookups

gcusello — Thu, 16 Sep 2021 09:01:19 GMT

Hi @shaquibk,

with append command you should have the results you need:

If you have more numbers for Avg_Count or Current_Count, instead values use another option in the stats command (e.g. max or sum).

Ciao.

Giuseppe

Re: Join results from two lookups

shaquibk — Thu, 16 Sep 2021 10:23:31 GMT

Thanks @ITWhisperer and @gcusello

Both the solutions were accurate and worked perfectly. Appreciate the prompt response too.

Thanks and Regards,

Shaquib