Dashboards & Visualizations

How to link two different CSVs that have one column in common?

mah
Builder

Hi, 

My issue is : 

I want to link 2 different CSVs that have 1 column in common. 

My first csv : 

account id year month total
aaa 111 2020 jan 445

 

My second csv : 

account_num platform
111 zzz

 

The values of the header id in the first CSV corresponding to th value of account_num in the second CSV.

What I want is to link both csv with the id/account_num so that platform values (2nd csv) match to the right account (1st csv).

Is there a way to do this? 

Thanks !

Labels (1)
Tags (2)
0 Karma

to4kawa
Ultra Champion
 
0 Karma

mah
Builder

OK thanks it correctly add at the end the end column platform !

Now, I want to create a request which gives me the following table : 

platformaccountjanfebmars...Total
Aaaa     
Abbb     
Bccc     
Bddd     

 

I created a request that gave me a part of the solution : 

| inputlookup append=t first_csv.csv
| lookup second_csv.csv account_number as id OUTPUT platform
| search Year="2020"
| search account=*
| chart sum(Total) by account, Month useother=false
| addtotals
| table account,Jan,Feb,Mar,Apr,May,Jun,Jul,Aug,Total

but how can I append the column platform like the table I want ? is it possible ? 

0 Karma

to4kawa
Ultra Champion



0 Karma

mah
Builder

Sorry I think you made a mistake in your answer because I already did that.

What I want is at the end a table like that : 

| table platform, account, janv,feb,...,Total 

 

 

 

 

 

 

0 Karma

mah
Builder

I have already tried that query, and it returns empty cells because the

| chart ...

makes a filter on account, month, Total so that it is impossible to have "platform" at the end in the
| table ....

0 Karma

to4kawa
Ultra Champion
 
0 Karma

mah
Builder

I think it is the chart command that filtering the result on fields account, month and total. 

accountjanfebmartotal
c14712
d25815
e36918

And after this command, even if I call the fields platform in the table command I will never have the values of that field because of the chart filtering.

Let me know if I am wrong.

I am looking for a solution where I can add platform column after the chart in order to have this table : 

platformaccountjanfebmartotal
Ac14712
Ad25815
Be36918

 

0 Karma

to4kawa
Ultra Champion
 
0 Karma

mah
Builder

Sorry for our misunderstanding and if I express myself badly.

Your solution works great ! 

Thanks a lot for your help.

0 Karma

to4kawa
Ultra Champion

Terrible.
That's the result of the new Splunk Answers, right?
I hope we don't have any more of these people around.

He didn't provide accurate information.
He changes what he says with every word he says.
No explanation of what was resolved.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...