Splunk Search

Compare two field values and get matching third value from table

ckunath
Communicator

Hello,

i'm trying to do a search and then compare my result with a table from a .csv file (contains a table with ids and text for each id).
My search:

index=foo eventid=200 | append [|inputlookup ids.csv] | table eventid id text

This gets me a table like this:

eventid | id | text
10      |    |
        | 1  | text1
        | 2  | text2

[...]

How can I change my search to make the table look like this?

id | text
10 | text10

Thanks in advance!

Tags (4)
0 Karma
1 Solution

lguinn2
Legend

If you want to get a matching value from a table, you need to use the lookup command.

 index=foo eventid=200 
| lookup ids.csv eventid as id OUTPUT id text
| table eventid id text

View solution in original post

lguinn2
Legend

If you want to get a matching value from a table, you need to use the lookup command.

 index=foo eventid=200 
| lookup ids.csv eventid as id OUTPUT id text
| table eventid id text

ckunath
Communicator

Thanks a lot for the quick response! Works as intended.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...