topic Re: Nested lookup search in Splunk Search

Nested lookup search

g_paternicola — Thu, 06 May 2021 06:52:08 GMT

Hi everyone, I'm trying to get the following search work, but for some reason I'm doing something wrong:

I'm basically trying to import event_id from a lookup ( notable_events_lookup) which is matching to another lookup (evets_lookup) in order to remove the matching event in the lookup (events_lookup)

I hope it makes sense what I'm trying to explain. Thanks everyone

Re: Nested lookup search

aasabatini — Thu, 06 May 2021 07:06:50 GMT

Hi @g_paternicola

try this

Re: Nested lookup search

g_paternicola — Thu, 06 May 2021 07:14:23 GMT

Thanks a lot! it works 🙂

Re: Nested lookup search

Taruchit — Fri, 20 May 2022 19:43:45 GMT

Hi @aasabatini

I have the below SPL: -

| inputlookup table1.csv where index="xxx" | fields index, host 
| search NOT [search index="xxx" | dedup host | table index, host]

I have table2.csv with following fields: -
index, host, lastTime

I need to search the results from above SPL based on host and index in table2.csv and get the corresponding value of the column: lastTime. Thus, as the final resultset, I need: - index, host, lastTime.

Please help with your suggestions.

Thank you