Splunk Enterprise

join two lookup tables

sarit_s
Communicator

Hello
i have two lookup tables 

from the first i want to take the field "created_by"
from the second i want to compare the "created_by" fields from the first lookup and check if the field "description" is empty or not.

if empty i want to raise an alert.

How can i join this two lookups?

thanks

Labels (1)
Tags (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

So,  you can use below;

| inputlookup first_lookup
| lookup second_lookup eventtype as created_by OUTPUT description
| where isnull(description)

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

If you are getting this error second_lookup has no "eventtype" field. Is it possible a typo?

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

So,  you can use below;

| inputlookup first_lookup
| lookup second_lookup eventtype as created_by OUTPUT description
| where isnull(description)

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

sarit_s
Communicator

i'm getting this error:
Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @sarit_s,

Please try below;

| inputlookup first_lookup
| lookup second_lookup created_by OUTPUT description
| where isnull(description)
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

sarit_s
Communicator

Hey,

Thanks for your reply
i think i forgot to mention that in the second lookup the field has different name so for example created_by (from first lookup) has to be equal to "eventtype" from second lookup and then i have to check if description is empty

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...