topic Re: How do I merge columns from a CSV with an existing input lookup file? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210085#M61451 <P>Try this</P> <PRE><CODE>| inputlookup new_windows_devices.csv | append [|inputlookup Windows.csv] | stats count by Hostname SourceType | fields - count </CODE></PRE> Mon, 08 Aug 2016 01:32:52 GMT sundareshr 2016-08-08T01:32:52Z How do I merge columns from a CSV with an existing input lookup file? https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210075#M61441 <P>Hi Team,</P> <P>I have an input lookup file called windows.CSV and have another .CSV file which contains host, sourcetype, and source details.</P> <P>How can we map these columns into the existing lookup file or merge two files into a single file?<BR /> Is it possible? Please suggest me.</P> <P>Host, Sourcetype and Source</P> <P>Regards,<BR /> Syed</P> Wed, 03 Aug 2016 04:31:34 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210075#M61441 syedsalam 2016-08-03T04:31:34Z Re: How do I merge columns from a CSV with an existing input lookup file? https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210076#M61442 <P>Hi syedsalam,</P> <P>I believe you can accomplish this by utilizing the append=t functionality of inputlookup. i.e.</P> <PRE><CODE>| inputlookup windows.csv | inputlookup other.csv append=t </CODE></PRE> <P>Please let me know if this answers your question!</P> Wed, 03 Aug 2016 17:46:39 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210076#M61442 muebel 2016-08-03T17:46:39Z Re: How do I merge columns from a CSV with an existing input lookup file? https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210077#M61443 <P>What is the common key field between the two files?</P> <P>You could either do a lookup or a join command but you need a common key.</P> Wed, 03 Aug 2016 17:47:00 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210077#M61443 sjohnson_splunk 2016-08-03T17:47:00Z Re: How do I merge columns from a CSV with an existing input lookup file? https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210078#M61444 <P>Host field is common key in both file.</P> Wed, 03 Aug 2016 17:57:58 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210078#M61444 syedsalam 2016-08-03T17:57:58Z Re: How do I merge columns from a CSV with an existing input lookup file? https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210079#M61445 <PRE><CODE> | inputlookup windows.csv | lookup other.csv host | outputlookup merged.csv </CODE></PRE> <P>This assumes that both are lookups (you didn't say that about the other.csv) if it's not then assuming it in var/run/splunk:</P> <PRE><CODE>| inputcsv other.csv | lookup windows.csv | outputlookup merged.csv </CODE></PRE> Wed, 03 Aug 2016 18:03:23 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210079#M61445 sjohnson_splunk 2016-08-03T18:03:23Z Re: How do I merge columns from a CSV with an existing input lookup file? https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210080#M61446 <P>Thanks John.</P> Wed, 03 Aug 2016 18:07:28 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210080#M61446 syedsalam 2016-08-03T18:07:28Z Re: How do I merge columns from a CSV with an existing input lookup file? https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210081#M61447 <P>Thanks Muebel.</P> Wed, 03 Aug 2016 18:11:03 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210081#M61447 syedsalam 2016-08-03T18:11:03Z Re: How do I merge columns from a CSV with an existing input lookup file? https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210082#M61448 <P>It's not working John.</P> Thu, 04 Aug 2016 04:29:30 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210082#M61448 syedsalam 2016-08-04T04:29:30Z Re: How do I merge columns from a CSV with an existing input lookup file? https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210083#M61449 <P>Hi Muebel,</P> <P>My query is I have one look up file in Splunk for asset and another CSV file in My system. i want to Join both file in to single file.</P> <P>is there any way to marge?</P> Thu, 04 Aug 2016 05:17:11 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210083#M61449 syedsalam 2016-08-04T05:17:11Z Re: How do I merge columns from a CSV with an existing input lookup file? https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210084#M61450 <P>Hi,</P> <P>Please suggest me, how to marge two files in to single file. Common key for both file is Hostname and SourceType.</P> <P>i should get only column of Hostname and SourceType not any other columns.<BR /> The file name is available below.</P> <P>| inputlookup new_windows_devices.csv | inputlookup Windows.csv</P> Tue, 29 Sep 2020 10:31:02 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210084#M61450 syedsalam 2020-09-29T10:31:02Z Re: How do I merge columns from a CSV with an existing input lookup file? https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210085#M61451 <P>Try this</P> <PRE><CODE>| inputlookup new_windows_devices.csv | append [|inputlookup Windows.csv] | stats count by Hostname SourceType | fields - count </CODE></PRE> Mon, 08 Aug 2016 01:32:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-merge-columns-from-a-CSV-with-an-existing-input-lookup/m-p/210085#M61451 sundareshr 2016-08-08T01:32:52Z