Hello,
I have this code for now:
index=host= sourcetype=csv source=C:\\2023-CW25_5.csv
| join type=left AssigneeID [inputlookup key_user.csv
| table NT_Name
| where AssigneeID = NT_Name
]
Have two csv files that I need to compare the columns AssigneeID from the 2023-CW25_5.csv file to the column NT_Name in the key-user.csv file and return the values from the Cluster column.
How can I do that?
Hi @KalebeRS,
you should use the lookup command (https://docs.splunk.com/Documentation/SCS/current/SearchReference/LookupCommandOverview) that's similar to a left join, something like this:
index=<your_index> host=<your_host> sourcetype=csv source="C:\\2023-CW25_5.csv"
| lookup key_user.csv NT_Name AS AssigneeID
| table ....
where AssigneeID is the correlation key in the main search and NT_Name is the correlation key in the lookup.
Ciao.
Giuseppe