- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to link two different CSVs that have one column in common?
Hi,
My issue is :
I want to link 2 different CSVs that have 1 column in common.
My first csv :
account | id | year | month | total |
aaa | 111 | 2020 | jan | 445 |
My second csv :
account_num | platform |
111 | zzz |
The values of the header id in the first CSV corresponding to th value of account_num in the second CSV.
What I want is to link both csv with the id/account_num so that platform values (2nd csv) match to the right account (1st csv).
Is there a way to do this?
Thanks !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK thanks it correctly add at the end the end column platform !
Now, I want to create a request which gives me the following table :
platform | account | jan | feb | mars | ... | Total |
A | aaa | |||||
A | bbb | |||||
B | ccc | |||||
B | ddd |
I created a request that gave me a part of the solution :
| inputlookup append=t first_csv.csv
| lookup second_csv.csv account_number as id OUTPUT platform
| search Year="2020"
| search account=*
| chart sum(Total) by account, Month useother=false
| addtotals
| table account,Jan,Feb,Mar,Apr,May,Jun,Jul,Aug,Total
but how can I append the column platform like the table I want ? is it possible ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry I think you made a mistake in your answer because I already did that.
What I want is at the end a table like that :
| table platform, account, janv,feb,...,Total
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have already tried that query, and it returns empty cells because the
| chart ...
makes a filter on account, month, Total so that it is impossible to have "platform" at the end in the
| table ....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think it is the chart command that filtering the result on fields account, month and total.
account | jan | feb | mar | total |
c | 1 | 4 | 7 | 12 |
d | 2 | 5 | 8 | 15 |
e | 3 | 6 | 9 | 18 |
And after this command, even if I call the fields platform in the table command I will never have the values of that field because of the chart filtering.
Let me know if I am wrong.
I am looking for a solution where I can add platform column after the chart in order to have this table :
platform | account | jan | feb | mar | total |
A | c | 1 | 4 | 7 | 12 |
A | d | 2 | 5 | 8 | 15 |
B | e | 3 | 6 | 9 | 18 |
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry for our misunderstanding and if I express myself badly.
Your solution works great !
Thanks a lot for your help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Terrible.
That's the result of the new Splunk Answers, right?
I hope we don't have any more of these people around.
He didn't provide accurate information.
He changes what he says with every word he says.
No explanation of what was resolved.
