Combining Lookups to a Table?

atebysandwich — Wed, 08 Feb 2023 16:36:49 GMT

I have two looksups that have a lists of subnets and name of the subnets. One lookup (subnet1.csv) as a field called name and subnet and the other (subnet2.csv) has fields named Name and Range. I would like to combine the two. So far I have this:

| inputlookup subnet1.csv | lookup subnet2.csv Name Range OUTPUT Range AS Subnet | table Name Subnet

This doesn't seem to work. When I run it, I only get the results from subnet1.csv and I can't seem to figure out why.

Re: Combining Lookups to a Table

caiosalonso — Tue, 07 Feb 2023 17:36:54 GMT

Hi,

Is it possible to provide an example of the data that the lookup files contain?

Also, when you run the lookup command, you are trying to match both "Name" and "Range" fields on subnet2.csv lookup? If that is the case, the subnet1.csv lookup contains both fields?

topic Re: Combining Lookups to a Table in Splunk Search

Combining Lookups to a Table?

Re: Combining Lookups to a Table