Splunk Search

How to use multisearch for inputlookup tables ? please provide an example.

Uday_Gonti
New Member

I want to check data from two different lookup tables and relate it using multisearch command.

0 Karma

RickWilson
Engager

I have a case where I have several lookup tables which I want to join on the same key. I use append to make the union of all the events, then use | stats values(*) as * by key to combine them back to a single event per key, with the union of all the lookup values. For my data volume, this works well.

| inputlookup file1.csv where condition
| append [ | inputlookup file2.csv where condition]
| append [ | inputlookup file3.csv where condition]

| stats values(*) as * by key
0 Karma

elliotproebstel
Champion

If you are consulting two lookup tables, it's unlikely that you need multisearch. You can string multiple lookup commands in a single query. Can you tell us more about what you're trying to do, and we can suggest a good approach?

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...