Dashboards & Visualizations

Get distinct rows when using inputlookup and lookup

Rgk_Trail
Explorer

Hi,

I am using combination of inputlookup and lookup to generate a report. I am using one field to join two lookup tables but both my tables have duplicate values. In the output I want to get unique rows containing fields from both lookup tables but I seem to get duplicate values in 2nd lookup table that I am joining. 

I am using dedup to remove duplicates from first table but It doesnt seem to work for second lookup. 

Can you suggest better way to do this ? 

Rgk_Trail_0-1599321480524.png

 

Labels (1)
0 Karma

Rgk_Trail
Explorer

Hi Giuseppe,

 Thanks for the quick response. I tried using your code but now it gives me error :

RROR LookupDataProvider - Could not find all of the specified lookup fields in the lookup table.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Rgk_Trail,

check all the field names (both the key field and the OUTPUT fields) remembering that field names are case sensitive.

Ciao.

Giuseppe

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Rgk_Trail,

which aggregation command are you using?

I think that using values you shoun't have  value duplication problems:

| inputlookup Issue_A
| rename Number AS Code
| lookup Issue_B Code OUTPUT Field4 Field5 Field6
| stats values(Field1) AS Field1 values(Field2) AS Field2 values(Field3) AS Field3 values(Field4) AS Field4 values(Field5) AS Field5 values(Field6) AS Field6 BY Code

 Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...