Other Usage

Why sistats doesn't work after lookup?

maayan
Path Finder

Hi,

I wrote a report that merge the result with lookup table to add fields (like machineName). the lookup table contain the field,source.
then, I do sistats as the following:

index=....search query... 
| lookup lk_table_name.csv source AS source
| sistats values(*) as * by TimeStamp,source

if I write sistats command after the lookup command the new fields from the lookup table disappear. 

if i write the sistats before the lookup command everything is ok but then i have other problem when i try to parse the summary index:
index=summary search_name="query_SummaryIndex_Main"
| stats values(*) as * by TimeStamp,source

what should i do? why sistats doesnt work after lookup?


thanks,
Maayan

Labels (2)
0 Karma
1 Solution

maayan
Path Finder

stupid solution but works- write stats before and after lookup:

| stats values(*) as * by TimeStamp,source

| lookup mylookup_table.csv source AS source

| stats values(*) as * by TimeStamp,source

View solution in original post

0 Karma

maayan
Path Finder

stupid solution but works- write stats before and after lookup:

| stats values(*) as * by TimeStamp,source

| lookup mylookup_table.csv source AS source

| stats values(*) as * by TimeStamp,source

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...