Dashboards & Visualizations

Unable to create lookup between 2 datasets- Why am I getting 3 empty columns?

POR160893
Builder

Hey.

I have a dataset as follows:

POR160893_0-1654082529960.png


I have a 2nd dataset as follows::

POR160893_1-1654082681947.png

 



I need to perform a lookup between both both I am getting 3 empty columns after the lookup from the 2nd dataset:

Can you please help?

POR160893_2-1654082724070.png

 

Here is the query I am using:

|inputlookup ABC
| eval AR_ID=_key
| lookup XYZ AR_ID as _key OUTPUT NodeName as SW_NodeName, FQDN as SW_FQDN, Product as SW_App



Thanks,

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do both your lookups have the _key field?

0 Karma

POR160893
Builder

No no, the common key would by AR_ID. AR_ID is already a field on the 2nd dataset and I am setting _key to be AR_ID on the 1st dataset.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If the field is already common, why are you changing it?

|inputlookup ABC
| lookup XYZ AR_ID OUTPUT NodeName as SW_NodeName, FQDN as SW_FQDN, Product as SW_App
0 Karma

POR160893
Builder

This only returns the data from 1st dataset .... no fields from the 2nd dataset.

0 Karma

POR160893
Builder

We need the AR_ID=_Key as that is the primary key between both datasets

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you saying that ABC has a field called _key which has the same values as field AR_ID in XYZ? If so, try this

|inputlookup ABC
| eval AR_ID=_key
| lookup XYZ AR_ID OUTPUT NodeName as SW_NodeName, FQDN as SW_FQDN, Product as SW_App
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...