Getting Data In

How to achieve lookup multiple field but append the missing value?

LearningGuy
Builder

How do I perform lookup multiple field but append the missing value.   Thanks
For example:
Table A:
Name        Role              IP
PaloAlto   Firewall       192.168.1.1
Cisco         Router         192.168.1.2

Table B
Name          Role           ConsoleIP
PaloAlto     Firewall    192.168.10.1
Cisco           Router      192.168.10.2
Siemens     Switch      192.168.10.3

Table A lookup table B results:
Name        Role              IP                                ConsoleIP
PaloAlto   Firewall       192.168.1.1           192.168.10.1
Cisco         Router         192.168.1.2           192.168.10.2
Siemens     Switch      <empty>                 192.168.10.3

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The general form for that is

<<your search for Table A>>
| append [ search <<your search for Table B ]
| stats values(*) as * by Name Role
---
If this reply helps you, Karma would be appreciated.

View solution in original post

LearningGuy
Builder

How do I do it if Table B is in CSV file?  Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Read the CSV instead of searching for Table B.

<<your search for Table A>>
| append [ | inputlookup TableB.csv ]
| stats values(*) as * by Name Role
---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

The general form for that is

<<your search for Table A>>
| append [ search <<your search for Table B ]
| stats values(*) as * by Name Role
---
If this reply helps you, Karma would be appreciated.

LearningGuy
Builder

Hello,
What is the reason you used "stat"?   
Does the CSV (Table B) need to have same exact field name as the Table A when using your search?
When I ran your command, it merged Name with multiple roles into 1 row
I need both tables are combined using 2 column name and role as  a key because the table has no unique ID, so it's kinda like a lookup, but if I use lookup, it won't catch value that's not on Table A (Siemens and Switch)

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The stats command regroups the results based on the values in the named fields (Name and Role, in this case).  It's how the two search results get put together into a single result set.

If done right, you should see one row for each pair of Name and Role values in either Table A or Table B.

---
If this reply helps you, Karma would be appreciated.

LearningGuy
Builder

Does the CSV (Table B) need to have same exact field name as the Table A when using your search?
It worked after I changed the field name (Name and Role) on Table B in CSV file to match the field names on Table A.
Is it possible to do it without matching the field names (Name and Role) on both Table A and Table B?

Please confirm this.  Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To get the right results, yes, Table A and Table B must share at least one field name.  If they don't share a field then stats cannot group the results.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...