Dashboards & Visualizations

How to join files to match values and return values from another column?

KalebeRS
Explorer

Hello,

 

I have this code for now:

index=host= sourcetype=csv source=C:\\2023-CW25_5.csv
| join type=left AssigneeID [inputlookup key_user.csv
| table NT_Name
| where AssigneeID = NT_Name
]

Have two csv files that I need to compare the columns AssigneeID from the 2023-CW25_5.csv file to the column NT_Name in the key-user.csv file and return the values from the Cluster column.

How can I do that?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @KalebeRS,

you should use the lookup command (https://docs.splunk.com/Documentation/SCS/current/SearchReference/LookupCommandOverview) that's  similar to a left join, something like this:

index=<your_index> host=<your_host> sourcetype=csv source="C:\\2023-CW25_5.csv"
| lookup key_user.csv NT_Name AS AssigneeID
| table ....

where AssigneeID is the correlation key in the main search and NT_Name is the correlation key in the lookup.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...