Splunk Enterprise

Lookup comparison

iamtheclient20
Explorer

Hello,

Example I have 2 lookups, first.csv and second.csv

first.csv have 1 column name=fruit_name and with multivalue

first.csv

fruit_name
apple
banana
melon
mango
grapes
guyabano
coconut



second.csv have 2 column fruits and remarks with multivalue under fruits column

fruits

remarks

apple
mango
guyabano

visible


How can i check if all the values of second.csv (apple,mango,guyabano) are present in the column fruit_name under first.csv then echo out the remarks with the value of visible


Thanks in advance

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

how have you set up your csv files so that they have multivalue fields?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Meet Splunk Observability Studio: AI-Assisted OpenTelemetry Instrumentation Without ...

Instrumentation is usually the last step or even an afterthought when building out a project. The feature ...

Federated Search for Cisco Security and Analytics Logging (SAL) is now GA on Splunk ...

Federated Search for Cisco  Security Analytics and Logging (SAL) is now generally available as part of the ...

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner   Join us for a demo-driven look at how ...