Archive

How to use multisearch for inputlookup tables ? please provide an example.

New Member

I want to check data from two different lookup tables and relate it using multisearch command.

0 Karma

Engager

I have a case where I have several lookup tables which I want to join on the same key. I use append to make the union of all the events, then use | stats values(*) as * by key to combine them back to a single event per key, with the union of all the lookup values. For my data volume, this works well.

| inputlookup file1.csv where condition
| append [ | inputlookup file2.csv where condition]
| append [ | inputlookup file3.csv where condition]

| stats values(*) as * by key
0 Karma

If you are consulting two lookup tables, it's unlikely that you need multisearch. You can string multiple lookup commands in a single query. Can you tell us more about what you're trying to do, and we can suggest a good approach?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!