Dashboards & Visualizations

Get distinct rows when using inputlookup and lookup

Rgk_Trail
Explorer

Hi,

I am using combination of inputlookup and lookup to generate a report. I am using one field to join two lookup tables but both my tables have duplicate values. In the output I want to get unique rows containing fields from both lookup tables but I seem to get duplicate values in 2nd lookup table that I am joining. 

I am using dedup to remove duplicates from first table but It doesnt seem to work for second lookup. 

Can you suggest better way to do this ? 

Rgk_Trail_0-1599321480524.png

 

Labels (1)
0 Karma

Rgk_Trail
Explorer

Hi Giuseppe,

 Thanks for the quick response. I tried using your code but now it gives me error :

RROR LookupDataProvider - Could not find all of the specified lookup fields in the lookup table.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Rgk_Trail,

check all the field names (both the key field and the OUTPUT fields) remembering that field names are case sensitive.

Ciao.

Giuseppe

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Rgk_Trail,

which aggregation command are you using?

I think that using values you shoun't have  value duplication problems:

| inputlookup Issue_A
| rename Number AS Code
| lookup Issue_B Code OUTPUT Field4 Field5 Field6
| stats values(Field1) AS Field1 values(Field2) AS Field2 values(Field3) AS Field3 values(Field4) AS Field4 values(Field5) AS Field5 values(Field6) AS Field6 BY Code

 Ciao.

Giuseppe

Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...