How to match two lookups in Splunk?

New Member

I have fields ComponentName, CNC in lookup A and fields ComponentName, ENDPOINT in lookup B. The output should have fields ComponentName,CNC,ENDPOINT. My criteria is that if the field ComponentName in both the lookups matches, the output should be displayed. Note-The field CNC in lookup A has its each of its value dependent upon the values of the field ComponentName in lookup A.

Tags (1)
0 Karma


Can you try this query;
| inputlookup A | inputlookup append=t B | stats values(CNC) AS CNC values(ENDPOINT) AS ENDPOINT by ComponentName | search CNC=* AND ENDPOINT=*

Let me know if this helps!!

0 Karma


Try this (untested) query.

index=foo | lookup A componentName OUTPUT CNC | lookup B componentName OUTPUT ENDPOINT | table componentName CNC ENDPOINT
If this reply helps you, an upvote would be appreciated.
0 Karma