topic Re: How to lookup against a csv file and join data with a multi-value field? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-lookup-against-a-csv-file-and-join-data-with-a-multi/m-p/173509#M49769 <P>Try this</P> <PRE><CODE>.... | join max=0 userid [|inputlookup testgroup.csv ] | stats values(group) as group by userid </CODE></PRE> Thu, 07 Aug 2014 03:48:00 GMT strive 2014-08-07T03:48:00Z How to lookup against a csv file and join data with a multi-value field? https://community.splunk.com/t5/Splunk-Search/How-to-lookup-against-a-csv-file-and-join-data-with-a-multi/m-p/173508#M49768 <P>I have a lookup file that is basically the following:</P> <PRE><CODE>userid,group 1,g1 1,g2 1,g3 2,g3 2,g1 </CODE></PRE> <P>I want to do a lookup against this table and return a multivalue field for each event.</P> <P>i.e. post lookup, if I do table userid, group, I should see:</P> <PRE><CODE>userid group ------------------------ 1 g1 g2 g3 ------------------------ 2 g1 g3 ------------------------ </CODE></PRE> <P>Basically the lookup should return all matches as a multivalue field. Right now if I'm using</P> <PRE><CODE>.... | join max=0 userid [inputlookup testgroup.csv ] | table userId group... </CODE></PRE> <P>But what happens is that each event just gets a single value (g1, g2 or g3) returned for group instead of a multivalued field that contains all matches.</P> Wed, 06 Aug 2014 21:35:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-lookup-against-a-csv-file-and-join-data-with-a-multi/m-p/173508#M49768 axdahl 2014-08-06T21:35:58Z Re: How to lookup against a csv file and join data with a multi-value field? https://community.splunk.com/t5/Splunk-Search/How-to-lookup-against-a-csv-file-and-join-data-with-a-multi/m-p/173509#M49769 <P>Try this</P> <PRE><CODE>.... | join max=0 userid [|inputlookup testgroup.csv ] | stats values(group) as group by userid </CODE></PRE> Thu, 07 Aug 2014 03:48:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-lookup-against-a-csv-file-and-join-data-with-a-multi/m-p/173509#M49769 strive 2014-08-07T03:48:00Z Re: How to lookup against a csv file and join data with a multi-value field? https://community.splunk.com/t5/Splunk-Search/How-to-lookup-against-a-csv-file-and-join-data-with-a-multi/m-p/173510#M49770 <P>that was it!, thanks.</P> Thu, 07 Aug 2014 22:47:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-lookup-against-a-csv-file-and-join-data-with-a-multi/m-p/173510#M49770 axdahl 2014-08-07T22:47:03Z