How to join files to match values and return values from another column?

[KalebeRS]

Hello,

I have this code for now:

index=host= sourcetype=csv source=C:\\2023-CW25_5.csv
| join type=left AssigneeID [inputlookup key_user.csv
| table NT_Name
| where AssigneeID = NT_Name
]

Have two csv files that I need to compare the columns AssigneeID from the 2023-CW25_5.csv file to the column NT_Name in the key-user.csv file and return the values from the Cluster column.

How can I do that?

[gcusello]

Hi @KalebeRS,

you should use the lookup command (https://docs.splunk.com/Documentation/SCS/current/SearchReference/LookupCommandOverview) that's  similar to a left join, something like this:

index=<your_index> host=<your_host> sourcetype=csv source="C:\\2023-CW25_5.csv"
| lookup key_user.csv NT_Name AS AssigneeID
| table ....

where AssigneeID is the correlation key in the main search and NT_Name is the correlation key in the lookup.

Ciao.

Giuseppe