topic How to display search with multiple lookup? [SOLVED] in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-display-search-with-multiple-lookup-SOLVED/m-p/604454#M210246 <P>Hello<BR />I have several lookups and I would like to display the details on a date range but I can't really do it<BR />I have tried several combinations but either I display the last one or I display too many elements<BR />As a bonus if I could have the total it would be cool</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| inputlookup file1.csv | append [| inputlookup file2.csv] | append [| inputlookup file3.csv] | append [| inputlookup file4.csv] | append [| inputlookup file5.csv] | append [| inputlookup file6.csv] | sort - _time | eval date = strftime(_time,"%Y-%m-%d") | search date&gt;2022-07-01 AND date&lt;2022-07-04 | transpose 6 | sort - column | search column=date OR column=count | fields - column | rename "row 1" as "name1", "row 2" as "name2", "row 3" as "name3", "row 4" as "name4", "row 5" as "name5", "row 6" as "name6"</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 12 Jul 2022 08:42:27 GMT brad_ 2022-07-12T08:42:27Z How to display search with multiple lookup? [SOLVED] https://community.splunk.com/t5/Splunk-Search/How-to-display-search-with-multiple-lookup-SOLVED/m-p/604454#M210246 <P>Hello<BR />I have several lookups and I would like to display the details on a date range but I can't really do it<BR />I have tried several combinations but either I display the last one or I display too many elements<BR />As a bonus if I could have the total it would be cool</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| inputlookup file1.csv | append [| inputlookup file2.csv] | append [| inputlookup file3.csv] | append [| inputlookup file4.csv] | append [| inputlookup file5.csv] | append [| inputlookup file6.csv] | sort - _time | eval date = strftime(_time,"%Y-%m-%d") | search date&gt;2022-07-01 AND date&lt;2022-07-04 | transpose 6 | sort - column | search column=date OR column=count | fields - column | rename "row 1" as "name1", "row 2" as "name2", "row 3" as "name3", "row 4" as "name4", "row 5" as "name5", "row 6" as "name6"</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 12 Jul 2022 08:42:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-search-with-multiple-lookup-SOLVED/m-p/604454#M210246 brad_ 2022-07-12T08:42:27Z Re: How to display search with multilple lookup https://community.splunk.com/t5/Splunk-Search/How-to-display-search-with-multiple-lookup-SOLVED/m-p/604459#M210250 <P>It is not clear what you are trying to achieve - can you share some of the events (contents of csv files) and what your expected output would be</P><P>Having said that, you might want to use where command rather than search and use unformatted epoch times</P><LI-CODE lang="markup">| where _time &gt; strptime("2022-07-01","%Y-%m-%d") AND _time &lt; strptime("2022-07-04","%Y-%m-%d") | transpose 6 | sort - column | where column="_time" OR column="count"</LI-CODE> Tue, 05 Jul 2022 14:53:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-search-with-multiple-lookup-SOLVED/m-p/604459#M210250 ITWhisperer 2022-07-05T14:53:57Z Re: How to display search with multilple lookup https://community.splunk.com/t5/Splunk-Search/How-to-display-search-with-multiple-lookup-SOLVED/m-p/604471#M210254 <P>Hello sorry to be unclear<BR />all lookup have the same model see below<BR /><BR /><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="lookup.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/20404i660B95C6B9AB35EC/image-size/large?v=v2&amp;px=999" role="button" title="lookup.PNG" alt="lookup.PNG" /></span><BR />I need to display the items per line for each date of the range see the result file</P><TABLE width="560"><TBODY><TR><TD width="80">Date</TD><TD width="80">file1</TD><TD width="80">file2</TD><TD width="80">file3</TD><TD width="80">file4</TD><TD width="80">file5</TD><TD width="80">file</TD></TR><TR><TD>04/07/2022</TD><TD>235</TD><TD>235</TD><TD>366</TD><TD>4554</TD><TD>56</TD><TD>83</TD></TR><TR><TD>05/07/2022</TD><TD>210</TD><TD>300</TD><TD>125</TD><TD>12011</TD><TD>15</TD><TD>13</TD></TR><TR><TD>06/07/2022</TD><TD>185</TD><TD>365</TD><TD>116</TD><TD>19468</TD><TD>26</TD><TD>57</TD></TR><TR><TD>07/07/2022</TD><TD>160</TD><TD>430</TD><TD>357</TD><TD>26925</TD><TD>67</TD><TD>127</TD></TR><TR><TD>08/07/2022</TD><TD>135</TD><TD>495</TD><TD>598</TD><TD>34382</TD><TD>108</TD><TD>198</TD></TR><TR><TD>Total&nbsp;</TD><TD>925</TD><TD>1825</TD><TD>1562</TD><TD>97340</TD><TD>272</TD><TD>478</TD></TR></TBODY></TABLE><P><BR />I hope that it is clearer<BR />Thx</P> Tue, 05 Jul 2022 16:00:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-search-with-multiple-lookup-SOLVED/m-p/604471#M210254 brad_ 2022-07-05T16:00:30Z Re: How to display search with multilple lookup https://community.splunk.com/t5/Splunk-Search/How-to-display-search-with-multiple-lookup-SOLVED/m-p/604477#M210258 <LI-CODE lang="markup">| inputlookup file1.csv | rename count as file1 | append [| inputlookup file2.csv | rename count as file2] | append [| inputlookup file3.csv | rename count as file3] | append [| inputlookup file4.csv | rename count as file4] | append [| inputlookup file5.csv | rename count as file5] | append [| inputlookup file6.csv | rename count as file6] | stats values(*) as * by _time | addtotals col=t row=f label=Total labelfield=_time</LI-CODE> Tue, 05 Jul 2022 16:32:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-search-with-multiple-lookup-SOLVED/m-p/604477#M210258 ITWhisperer 2022-07-05T16:32:43Z Re: How to display search with multiple lookup? [SOLVED] https://community.splunk.com/t5/Splunk-Search/How-to-display-search-with-multiple-lookup-SOLVED/m-p/605267#M210472 <P>Thx for your help</P> Tue, 12 Jul 2022 08:55:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-search-with-multiple-lookup-SOLVED/m-p/605267#M210472 brad_ 2022-07-12T08:55:13Z