Getting Data In

I have to combine two csv files of the lookup?

chitreshakumar
Communicator

The field is having created date till some time in first file and after that duration i have the data in other csv file .How can I combine these files ?Each of the file is having one unique field values for one particular field .Just take it as field1

0 Karma
1 Solution

493669
Super Champion

hi,
Try this:

| inputlookup lookup1.csv |table field1| append [| inputlookup append=true lookup2.csv |table field1] | table field1

View solution in original post

493669
Super Champion

hi,
Try this:

| inputlookup lookup1.csv |table field1| append [| inputlookup append=true lookup2.csv |table field1] | table field1

chitreshakumar
Communicator

Will that contain created date field along with field1.Or should I add
| inputlookup lookup1.csv |table field1,created_date| append [| inputlookup append=true lookup2.csv |table field1,created_date] | table field1,created_date

0 Karma

493669
Super Champion

yes you need to add
or try this also:

| inputlookup lookup1.csv | append [| inputlookup append=true lookup2.csv ] | table field1, created_date
0 Karma

chitreshakumar
Communicator

Ok Thanks!!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...