Solved: Re: How to search and compare the same data across...

dteo827 · ‎01-06-2016

Greetings Splunk Answers,
I have 4 CSV's containing similar data (usernames, first/last names, job roles) all of which I have imported into individual KV Stores (and separate collections).
I need to search a username and see if it is any/all of the KV Stores.

Does anyone have experience searching across multiple KV Stores for the same data?

Cheers!

renjith_nair · ‎01-06-2016

Try

| inputlookup kv1 | inputlookup append=t kv2 | inputlookup append=t kv3 | inputlookup append=t kv4|search username=<username_to_search>

http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Inputlookup

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair · ‎01-06-2016

Try

| inputlookup kv1 | inputlookup append=t kv2 | inputlookup append=t kv3 | inputlookup append=t kv4|search username=<username_to_search>

http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Inputlookup

---
What goes around comes around. If it helps, hit it with Karma 🙂

dteo827 · ‎01-06-2016

Many thanks, I somehow missed that in the documentation.

How to search and compare the same data across multiple KV stores?

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

Data Persistence in the OpenTelemetry Collector

Thanks for the Memories! Splunk University, .conf25, and our Community

Are you a member of the Splunk Community?

How to search and compare the same data across multiple KV stores?

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

Data Persistence in the OpenTelemetry Collector

Thanks for the Memories! Splunk University, .conf25, and our Community