Hi,
My issue is :
I want to link 2 different CSVs that have 1 column in common.
My first csv :
account | id | year | month | total |
aaa | 111 | 2020 | jan | 445 |
My second csv :
account_num | platform |
111 | zzz |
The values of the header id in the first CSV corresponding to th value of account_num in the second CSV.
What I want is to link both csv with the id/account_num so that platform values (2nd csv) match to the right account (1st csv).
Is there a way to do this?
Thanks !
OK thanks it correctly add at the end the end column platform !
Now, I want to create a request which gives me the following table :
platform | account | jan | feb | mars | ... | Total |
A | aaa | |||||
A | bbb | |||||
B | ccc | |||||
B | ddd |
I created a request that gave me a part of the solution :
| inputlookup append=t first_csv.csv
| lookup second_csv.csv account_number as id OUTPUT platform
| search Year="2020"
| search account=*
| chart sum(Total) by account, Month useother=false
| addtotals
| table account,Jan,Feb,Mar,Apr,May,Jun,Jul,Aug,Total
but how can I append the column platform like the table I want ? is it possible ?
Sorry I think you made a mistake in your answer because I already did that.
What I want is at the end a table like that :
| table platform, account, janv,feb,...,Total
I have already tried that query, and it returns empty cells because the
| chart ...
makes a filter on account, month, Total so that it is impossible to have "platform" at the end in the
| table ....
I think it is the chart command that filtering the result on fields account, month and total.
account | jan | feb | mar | total |
c | 1 | 4 | 7 | 12 |
d | 2 | 5 | 8 | 15 |
e | 3 | 6 | 9 | 18 |
And after this command, even if I call the fields platform in the table command I will never have the values of that field because of the chart filtering.
Let me know if I am wrong.
I am looking for a solution where I can add platform column after the chart in order to have this table :
platform | account | jan | feb | mar | total |
A | c | 1 | 4 | 7 | 12 |
A | d | 2 | 5 | 8 | 15 |
B | e | 3 | 6 | 9 | 18 |
Sorry for our misunderstanding and if I express myself badly.
Your solution works great !
Thanks a lot for your help.
Terrible.
That's the result of the new Splunk Answers, right?
I hope we don't have any more of these people around.
He didn't provide accurate information.
He changes what he says with every word he says.
No explanation of what was resolved.