Getting Data In

How to use inputlookup with csv file to import two multi value fields in a search?

C_Sparn
Communicator

Hello,
I try to use inputlookup with a csv file to import two multi value fields in a search.
The two fields are both filled with numbers seperated with "," like 0012345678101112,5.
The field names are tickets and days.
Now I try to compare another field(Tickets)with the tickets field.
The problem is now that when I compare the 2 fields there are no accordances. I also tried to convert the fields to String and to Numbers but that didn't help either.

The code looks like this:

mainsearch...
|append[|inputlookup input.csv]
|eval tickets = toNumber(tickets)
|where Tickets == tickets
|stats dc(Tickets)

Tickets is typeof Number so it should work.
Where is the error?
Greetings

1 Solution

strive
Influencer

I tried this and it worked.

I created test1.csv with two columns Ticket and Days

Base Search | stats count as Count by TicketCode | appendcols [|inputlookup test1.csv] | where TicketCode == Ticket | stats dc(TicketCode)

The above works when the field values are in same order.

You may try this

Base search | stats count as Count by TicketCode | rename TicketCode as Ticket| join Ticket[|inputlookup test1.csv] | stats dc(Ticket) 

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

What do your events and your lookup file look like?
What does the desired result look like?

0 Karma

strive
Influencer

I tried this and it worked.

I created test1.csv with two columns Ticket and Days

Base Search | stats count as Count by TicketCode | appendcols [|inputlookup test1.csv] | where TicketCode == Ticket | stats dc(TicketCode)

The above works when the field values are in same order.

You may try this

Base search | stats count as Count by TicketCode | rename TicketCode as Ticket| join Ticket[|inputlookup test1.csv] | stats dc(Ticket) 

C_Sparn
Communicator

I found a solution with testing your code:
My solustion looks like this:

Base search | rename TicketCode as Ticket| join Ticket[|inputlookup test1.csv|rename tickets as Tickets]
|stats dc(Ticket)

Then the join is correct and I can use all other fields of the csv file in the main search.
Thanks for the answers.

Greetings

C_Sparn
Communicator

Hello,
thanks for the answer, but both solutions are not working for me. With appendcols I get a table with each one ticket and one day value. But it is not the right day value like in the csv file. Join just gives no results. Also the where clause after appendcols gives no results in my search.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Classic British Rock Bands

This puzzle series (first published here) is based on extracting information from statements about well-known ...

New to the Community? Join Us for an Exclusive Post .conf26 Welcome Session (Plus a ...

Keep the .conf26 Energy Going: Welcome to the Splunk Community! Whether we scanned your badge at the Community ...

Accelerate Splunk App Development with AI

  Learn how to automate the repetitive parts of your build cycle.   Register to Attend   Join our Tech Talk ...