Greetings Splunk Answers,
I have 4 CSV's containing similar data (usernames, first/last names, job roles) all of which I have imported into individual KV Stores (and separate collections).
I need to search a username and see if it is any/all of the KV Stores.
Does anyone have experience searching across multiple KV Stores for the same data?
Cheers!
Try
| inputlookup kv1 | inputlookup append=t kv2 | inputlookup append=t kv3 | inputlookup append=t kv4|search username=<username_to_search>
http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Inputlookup
Try
| inputlookup kv1 | inputlookup append=t kv2 | inputlookup append=t kv3 | inputlookup append=t kv4|search username=<username_to_search>
http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Inputlookup
Many thanks, I somehow missed that in the documentation.