topic How to append a inputlookup table with a main table, in a desired order. in Splunk Search

How to append a inputlookup table with a main table, in a desired order.

vinod743374 — Tue, 15 Feb 2022 09:36:45 GMT

I am looking for one requirement, can anyone please help us.

i want to append a inputlookup table to my main table with the same column names and field names.

Here is my main search results.

Here is my inputlookup results

Desired Output:

Re: How to append a inputlookup table with a main table, in a desired order.

gcusello — Tue, 15 Feb 2022 09:41:34 GMT

Hi @vinod743374,

you could use the append command, something like this:

I supposed that the enabled password is a field and not a count

Ciao

Giuseppe

Re: How to append a inputlookup table with a main table, in a desired order.

vinod743374 — Tue, 15 Feb 2022 09:49:43 GMT

yup I know the append will works,
But I need in a specific order like in the Desired output Image.

Is there any possibility to append after the same value.

Re: How to append a inputlookup table with a main table, in a desired order.

vinod743374 — Tue, 15 Feb 2022 10:03:57 GMT

I have already achieved this in a manual way,

I used a case function to give a number to every value(which order it should appear) of the Compliance field and sorted.

But I need in such a way that , no need of Adding the query for every latest data.

Any suggestion or Idea would be appreciated.

Thankyou.

Re: How to append a inputlookup table with a main table, in a desired order.

gcusello — Tue, 15 Feb 2022 11:23:05 GMT

Hi @vinod743374,

you have to extract an additional field from Compliant to use only for sorting, something like this:

Ciao.

Giuseppe

Re: How to append a inputlookup table with a main table, in a desired order.

vinod743374 — Tue, 15 Feb 2022 12:31:08 GMT

strpdate is not working , i replaced with strptime, but it doesn't return any values in the sort_date field.
i sorted it without conversion,
its working but not exactly I want,

Thanks for the help.

Re: How to append a inputlookup table with a main table, in a desired order.

gcusello — Tue, 15 Feb 2022 12:47:08 GMT

Hi @vinod743374,

sorry strptime!

it's strange, because it should transform the date in Compliance in an epochtime, maybe also the year is needed, please try this:

Ciao.

Giuseppe

Re: How to append a inputlookup table with a main table, in a desired order.

vinod743374 — Tue, 15 Feb 2022 13:06:03 GMT

Mistyped the $ instead of % in the time format.
Now its Working Fine I replaced the $ with %,

Thanks for the solution.

Re: How to append a inputlookup table with a main table, in a desired order.

gcusello — Tue, 15 Feb 2022 13:10:45 GMT

Hi @vinod743374,

sorry for the error, good for you.

ciao and happy splunking.

Giuseppe