How to get values from two lookups to my current search?

[revanthammineni]

Hi Splunkers, I need a help in coming up with a logic in getting values from two lookups to my current search.

I'm working on a search which has a field "customer" and I need to bring their ids from two different lookups. Basically, I have to check both the lookups for their ids and write them in the field called "ID" in my current search. TIA

Search :

customer       ID
a                     

b         

c         

d           

e         

lookup 1                                   lookup 2
customer       ids                    customer      ids
a                         1                         d                      4
b                         2                         e                      5
c                         3                         a                      1
                            

[gcusello]

Hi @revanthammineni,

you have to apply two times the lookup command (https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Lookup) , something like this:

<your_search>
| lookup your_lookupA.csv customer OUTPUT ids
| lookup your_lookupB.csv customer OUTPUT ids
| table customer ids

Ciao.

Giuseppe