Dashboards & Visualizations

Get distinct rows when using inputlookup and lookup

Rgk_Trail
Explorer

Hi,

I am using combination of inputlookup and lookup to generate a report. I am using one field to join two lookup tables but both my tables have duplicate values. In the output I want to get unique rows containing fields from both lookup tables but I seem to get duplicate values in 2nd lookup table that I am joining. 

I am using dedup to remove duplicates from first table but It doesnt seem to work for second lookup. 

Can you suggest better way to do this ? 

Rgk_Trail_0-1599321480524.png

 

Labels (1)
0 Karma

Rgk_Trail
Explorer

Hi Giuseppe,

 Thanks for the quick response. I tried using your code but now it gives me error :

RROR LookupDataProvider - Could not find all of the specified lookup fields in the lookup table.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Rgk_Trail,

check all the field names (both the key field and the OUTPUT fields) remembering that field names are case sensitive.

Ciao.

Giuseppe

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Rgk_Trail,

which aggregation command are you using?

I think that using values you shoun't have  value duplication problems:

| inputlookup Issue_A
| rename Number AS Code
| lookup Issue_B Code OUTPUT Field4 Field5 Field6
| stats values(Field1) AS Field1 values(Field2) AS Field2 values(Field3) AS Field3 values(Field4) AS Field4 values(Field5) AS Field5 values(Field6) AS Field6 BY Code

 Ciao.

Giuseppe

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...