https://community.splunk.com/t5/Splunk-Search/Problem-with-Lookup-table/m-p/20254#M3142 <P>Issue was in the lookup tables itself. Rectified it. Thanks for the help/</P> Fri, 02 Nov 2012 13:04:14 GMT theouhuios 2012-11-02T13:04:14Z https://community.splunk.com/t5/Splunk-Search/Problem-with-Lookup-table/m-p/20250#M3138 <P>Hello</P> <P>While using lookup table there are multiple entries coming up even when in the lookup table they have distinct values stored.</P> <P>Here is a gist of data in the lookup file</P> <P>threshold CI<BR /> "1.00",AN100489<BR /> "1.00",WASBFBLV<BR /> "1.00",AN100369<BR /> "1.00",AN100357<BR /> "1.00",AN100399<BR /> "1.00",AN100281<BR /> "1.00",AN100090<BR /> "1.00",AN100570<BR /> "1.00",WASBHJ8B</P> <P>Now when I use it in search</P> <PRE><CODE>sourcetype="incident"| rename record.affectedCI as CI | lookup threshold-Lookup CI AS CI OUTPUT threshold AS threshold | table CI threshold| </CODE></PRE> <P>the data comes as <BR /> 1 WTSDK3LD<BR /><BR /> 2 WTSDHFTB 1.00<BR /> 3 WTSDHFTB 1.00<BR /> 4 WTSDHFTB 1.00<BR /> 5 WTSDHFS4 1.00<BR /> 6 WTSDHFS4 1.00<BR /> 7 WTSDC4NQ 1.00<BR /> 8 WTSDC4NQ 1.00<BR /> 9 WTSDC4NQ 1.00<BR /> 10 WTSDC4NQ 1.00<BR /> 11 WTSDC4NQ 1.00<BR /> 12 WTSDC4NQ 1.00<BR /> 13 WTSDB9JG 1.00</P> <P>Any idea on how can I make it distinct so that it lists it only once? I need it to be uniq as I will be comparing the threshold to other fields to generate emails.</P> <P>Please help.</P> <P>Regards</P> <P>theou</P> Thu, 01 Nov 2012 14:31:53 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-Lookup-table/m-p/20250#M3138 theouhuios 2012-11-01T14:31:53Z https://community.splunk.com/t5/Splunk-Search/Problem-with-Lookup-table/m-p/20251#M3139 <P>I believe you want the dedup command. </P> <P><CODE>sourcetype="incident"| rename record.affectedCI as CI | lookup threshold-Lookup CI AS CI OUTPUT threshold AS threshold | dedup CI| table CI threshold</CODE></P> <P><CODE><A href="http://www.splunk.com/base/Documentation/5.0/SearchReference/Dedup" target="test_blank">http://www.splunk.com/base/Documentation/5.0/SearchReference/Dedup</A></CODE></P> Thu, 01 Nov 2012 14:37:51 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-Lookup-table/m-p/20251#M3139 alacercogitatus 2012-11-01T14:37:51Z https://community.splunk.com/t5/Splunk-Search/Problem-with-Lookup-table/m-p/20252#M3140 <P>I tried with dedup too. But it's still the same.</P> <PRE><CODE>WASDQYMK </CODE></PRE> <P>1.00<BR /> 1.00<BR /> 1.00<BR /> 1.00</P> <P>Would this be an issue with the lookup table?</P> Thu, 01 Nov 2012 15:02:47 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-Lookup-table/m-p/20252#M3140 theouhuios 2012-11-01T15:02:47Z https://community.splunk.com/t5/Splunk-Search/Problem-with-Lookup-table/m-p/20253#M3141 <P>How about: <CODE>sourcetype="incident" | lookup threshold-Lookup record.affectedCI AS CI OUTPUT threshold|dedup CI |stats values(threshold) as threshold by CI</CODE> ? If not, could you provide a table of the information you'd like to see? (please use backticks to preserve formatting)</P> Thu, 01 Nov 2012 15:05:44 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-Lookup-table/m-p/20253#M3141 alacercogitatus 2012-11-01T15:05:44Z https://community.splunk.com/t5/Splunk-Search/Problem-with-Lookup-table/m-p/20254#M3142 <P>Issue was in the lookup tables itself. Rectified it. Thanks for the help/</P> Fri, 02 Nov 2012 13:04:14 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-Lookup-table/m-p/20254#M3142 theouhuios 2012-11-02T13:04:14Z