Dashboards & Visualizations

Get distinct rows when using inputlookup and lookup

Rgk_Trail
Explorer

Hi,

I am using combination of inputlookup and lookup to generate a report. I am using one field to join two lookup tables but both my tables have duplicate values. In the output I want to get unique rows containing fields from both lookup tables but I seem to get duplicate values in 2nd lookup table that I am joining. 

I am using dedup to remove duplicates from first table but It doesnt seem to work for second lookup. 

Can you suggest better way to do this ? 

Rgk_Trail_0-1599321480524.png

 

Labels (1)
0 Karma

Rgk_Trail
Explorer

Hi Giuseppe,

 Thanks for the quick response. I tried using your code but now it gives me error :

RROR LookupDataProvider - Could not find all of the specified lookup fields in the lookup table.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Rgk_Trail,

check all the field names (both the key field and the OUTPUT fields) remembering that field names are case sensitive.

Ciao.

Giuseppe

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Rgk_Trail,

which aggregation command are you using?

I think that using values you shoun't have  value duplication problems:

| inputlookup Issue_A
| rename Number AS Code
| lookup Issue_B Code OUTPUT Field4 Field5 Field6
| stats values(Field1) AS Field1 values(Field2) AS Field2 values(Field3) AS Field3 values(Field4) AS Field4 values(Field5) AS Field5 values(Field6) AS Field6 BY Code

 Ciao.

Giuseppe

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...