Splunk Enterprise

join two lookup tables

sarit_s
Communicator

Hello
i have two lookup tables 

from the first i want to take the field "created_by"
from the second i want to compare the "created_by" fields from the first lookup and check if the field "description" is empty or not.

if empty i want to raise an alert.

How can i join this two lookups?

thanks

Labels (1)
Tags (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

So,  you can use below;

| inputlookup first_lookup
| lookup second_lookup eventtype as created_by OUTPUT description
| where isnull(description)

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

If you are getting this error second_lookup has no "eventtype" field. Is it possible a typo?

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

So,  you can use below;

| inputlookup first_lookup
| lookup second_lookup eventtype as created_by OUTPUT description
| where isnull(description)

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

sarit_s
Communicator

i'm getting this error:
Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @sarit_s,

Please try below;

| inputlookup first_lookup
| lookup second_lookup created_by OUTPUT description
| where isnull(description)
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

sarit_s
Communicator

Hey,

Thanks for your reply
i think i forgot to mention that in the second lookup the field has different name so for example created_by (from first lookup) has to be equal to "eventtype" from second lookup and then i have to check if description is empty

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...