https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306256#M91955 <P>is there any space between Action and Required in lookup?</P> Fri, 23 Feb 2018 12:03:38 GMT 493669 2018-02-23T12:03:38Z https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306251#M91950 <P>I have 3 lookup files. <BR /> I want to take EmpNum from fiel1.csv searching for that in file2.csv to get the email id and generate an email alert to all those emails when todays date is = ActionRequired date. Now its hard coded i want to add one more lookup file dates.csv where i will place these dates. Now how can to write the query to get the date ActionRequired into that variable for comparison. </P> <P>|inputlookup file1.csv |rename "Employee ID" as EmpNum |search "Enrollment Status"=Enrolled OR "Enrollment Status"="In-Progress" |eval ActionRequired="2018-02-23" | eval today=strftime(now(),"%Y-%m-%d")| where ActionRequired=today |fields "Name" "EmpNum" |lookup file2.csv "Employee ID" as "EmpNum" output "Manager Email" as email "Employee Email" | stats values(EmpNum) as "Employee ID" list(Employee Email) as "Employee Email ID" by email</P> <P>dates.csv looks like this:<BR /> I can use this query to just get the ActionRequired field from this file. <BR /> |inputlooku dates.csv |search Description=MPC |field "Action Required" </P> <P>Help</P> Fri, 23 Feb 2018 11:17:17 GMT https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306251#M91950 surekhasplunk 2018-02-23T11:17:17Z https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306252#M91951 <P>is there any common field in <CODE>file1.csv</CODE> and <CODE>dates.csv</CODE> like field <CODE>Description</CODE></P> Fri, 23 Feb 2018 11:28:12 GMT https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306252#M91951 493669 2018-02-23T11:28:12Z https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306253#M91952 <P>No common field. thats where am getting confused. <BR /> But i can hardcode that value "Description"=MPC</P> Fri, 23 Feb 2018 11:31:30 GMT https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306253#M91952 surekhasplunk 2018-02-23T11:31:30Z https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306254#M91953 <P>okay then try this:</P> <PRE><CODE>|inputlookup file1.csv |rename "Employee ID" as EmpNum |search "Enrollment Status"=Enrolled OR "Enrollment Status"="In-Progress" |eval Description="MPC" |lookup dates.csv Description OUTPUT ActionRequired|&lt;remaining query&gt; </CODE></PRE> Fri, 23 Feb 2018 11:36:49 GMT https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306254#M91953 493669 2018-02-23T11:36:49Z https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306255#M91954 <P>Somehow ActionRequired is coming as blank <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span> </P> Fri, 23 Feb 2018 12:01:37 GMT https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306255#M91954 surekhasplunk 2018-02-23T12:01:37Z https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306256#M91955 <P>is there any space between Action and Required in lookup?</P> Fri, 23 Feb 2018 12:03:38 GMT https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306256#M91955 493669 2018-02-23T12:03:38Z https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306257#M91956 <P>Yes again the culprit double quotes .. Thanks much ...:) working now.</P> Fri, 23 Feb 2018 12:08:44 GMT https://community.splunk.com/t5/Splunk-Search/lookup-files-for-alert-creating/m-p/306257#M91956 surekhasplunk 2018-02-23T12:08:44Z