https://community.splunk.com/t5/Splunk-Search/Why-can-t-I-use-my-lookup-command-after-stats-command-in-my/m-p/315035#M94320 <P>I am trying to use stats command to display data organized by <CODE>My_Field</CODE> where <CODE>My_Field</CODE> is populated by running <CODE>lookup my_lookup_script username AS user</CODE> </P> <P>Here's the example of the search string:</P> <PRE><CODE>| stats STUFF by My_Field | lookup my_lookup_script username AS user </CODE></PRE> <P>My problem is that <CODE>My_Field</CODE> is not populated for the stats command to use because the lookup command happens after the stats command. I tried simply running the lookup BEFORE the stats command but the lookup needs to run at the end of the search because if it does not then the lookup does not work properly. If the lookup runs before the stats command It gets inconsistent values for <CODE>user</CODE>. Seems like the lookup has to be at the end so the whole search can finish running and have the correct data in <CODE>user</CODE> for the script to use.</P> <P>How can I have the lookup run after that stats command to where the stats command can use the <CODE>My_Field</CODE></P> Thu, 31 Aug 2017 18:41:59 GMT jcorkey 2017-08-31T18:41:59Z https://community.splunk.com/t5/Splunk-Search/Why-can-t-I-use-my-lookup-command-after-stats-command-in-my/m-p/315035#M94320 <P>I am trying to use stats command to display data organized by <CODE>My_Field</CODE> where <CODE>My_Field</CODE> is populated by running <CODE>lookup my_lookup_script username AS user</CODE> </P> <P>Here's the example of the search string:</P> <PRE><CODE>| stats STUFF by My_Field | lookup my_lookup_script username AS user </CODE></PRE> <P>My problem is that <CODE>My_Field</CODE> is not populated for the stats command to use because the lookup command happens after the stats command. I tried simply running the lookup BEFORE the stats command but the lookup needs to run at the end of the search because if it does not then the lookup does not work properly. If the lookup runs before the stats command It gets inconsistent values for <CODE>user</CODE>. Seems like the lookup has to be at the end so the whole search can finish running and have the correct data in <CODE>user</CODE> for the script to use.</P> <P>How can I have the lookup run after that stats command to where the stats command can use the <CODE>My_Field</CODE></P> Thu, 31 Aug 2017 18:41:59 GMT https://community.splunk.com/t5/Splunk-Search/Why-can-t-I-use-my-lookup-command-after-stats-command-in-my/m-p/315035#M94320 jcorkey 2017-08-31T18:41:59Z https://community.splunk.com/t5/Splunk-Search/Why-can-t-I-use-my-lookup-command-after-stats-command-in-my/m-p/315036#M94321 <P>You are telling us your conclusions rather than your business requirements. Here's a total stab in the dark.</P> <PRE><CODE> your search | stats STUFF by user | lookup my_lookup_script username AS user | stats MORESTUFF by My_Field </CODE></PRE> <P>If that is not the strategy that you are looking for, then explain the following things - </P> <P>1) what is in the raw fields to be aggregated<BR /> 2) what is the actual field being looked up, and the output fields<BR /> 3) what happens when you put the lookup before the first stats, and why do you think that is incorrect.</P> <P>One other thing you can check first - is the capitalization of user field values consistently the same as are in the lookup table? If not, consider using <CODE>upper()</CODE> or <CODE>lower()</CODE> to make it so.</P> Thu, 31 Aug 2017 19:59:28 GMT https://community.splunk.com/t5/Splunk-Search/Why-can-t-I-use-my-lookup-command-after-stats-command-in-my/m-p/315036#M94321 DalJeanis 2017-08-31T19:59:28Z