Splunk Enterprise

Lookup comparison

iamtheclient20
Explorer

Hello,

Example I have 2 lookups, first.csv and second.csv

first.csv have 1 column name=fruit_name and with multivalue

first.csv

fruit_name
apple
banana
melon
mango
grapes
guyabano
coconut



second.csv have 2 column fruits and remarks with multivalue under fruits column

fruits

remarks

apple
mango
guyabano

visible


How can i check if all the values of second.csv (apple,mango,guyabano) are present in the column fruit_name under first.csv then echo out the remarks with the value of visible


Thanks in advance

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

how have you set up your csv files so that they have multivalue fields?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...