Splunk Enterprise Security

How to merge multiple lookup field values into single field value

lksridhar
Explorer

Hi Folks,

I have two lookup files which contain the user information such as username, email and company.

for example:

1. First lookup file.

user               email                               company

siva              siva11@gmail.com     google

arun              arun11@gmail.com

2. Second lookup file.

user             email                                company

arun            arun11@gmail.com   yahoo

how to merge the two lookup files and merge the value.

the expected output should be like this.

user     email                                company

siva    siva11@gmail.com      google

arun   arun11@gmail.com    yahoo

 

Could you please anyone suggest to get the expected results.

 

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@lksridhar 

Try something like,

|inputlookup first_lookup.csv | append [|inputlookup second_lookup.csv ]| stats values(*) as * by user

 

KV 

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...