Dashboards & Visualizations

Unable to create lookup between 2 datasets- Why am I getting 3 empty columns?

POR160893
Builder

Hey.

I have a dataset as follows:

POR160893_0-1654082529960.png


I have a 2nd dataset as follows::

POR160893_1-1654082681947.png

 



I need to perform a lookup between both both I am getting 3 empty columns after the lookup from the 2nd dataset:

Can you please help?

POR160893_2-1654082724070.png

 

Here is the query I am using:

|inputlookup ABC
| eval AR_ID=_key
| lookup XYZ AR_ID as _key OUTPUT NodeName as SW_NodeName, FQDN as SW_FQDN, Product as SW_App



Thanks,

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do both your lookups have the _key field?

0 Karma

POR160893
Builder

No no, the common key would by AR_ID. AR_ID is already a field on the 2nd dataset and I am setting _key to be AR_ID on the 1st dataset.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If the field is already common, why are you changing it?

|inputlookup ABC
| lookup XYZ AR_ID OUTPUT NodeName as SW_NodeName, FQDN as SW_FQDN, Product as SW_App
0 Karma

POR160893
Builder

This only returns the data from 1st dataset .... no fields from the 2nd dataset.

0 Karma

POR160893
Builder

We need the AR_ID=_Key as that is the primary key between both datasets

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you saying that ABC has a field called _key which has the same values as field AR_ID in XYZ? If so, try this

|inputlookup ABC
| eval AR_ID=_key
| lookup XYZ AR_ID OUTPUT NodeName as SW_NodeName, FQDN as SW_FQDN, Product as SW_App
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...