Hi,
Below is a result of a lookup command, how do I exclude the other information if I based in on BusinessUnit, For ex. I want to show BU2 only... but there maybe cases that I need to show BU1 only. How can I filter my lookup result?
Application BusinessUnit DATE CALCMIPS
App1 App2 App3 App4 | BU1 BU2 BU1 BU1 | 31DEC2020 | 20
|
My splunk query looks like
index=index1 sourcetype=source1 [ |inputlookup Application.csv where BusinessUnit = BU1 | return 1000 ACCOUNT_CODE] | lookup Application.csv ACCOUNT_CODE OUTPUT Application BusinessUnit ApplicationRTO | table Application BusinessUnit DATE MVS_SYSTEM_ID CALCMIPS
Thanks and Regards,
Hi,
I just included the BU as part of my lookup. That made it more distinct.
eval BusinessUnit = "BU1" | lookup Application.csv ACCOUNT_CODE BusinessUnit OUTPUT Application
Thanks and Regards,
What are you trying to accomplish with this bit:
[ |inputlookup Application.csv where BusinessUnit = BU1 | return 1000 ACCOUNT_CODE]
Because it looks to me like there is no field 'ACCOUNT_CODE' in the lookup, so this is going to return null.
Also, based on the way you displayed the output of the lookup are the Application and Business Unit multivalue?
Lastly, I think it's not fully clear what you're trying to accomplish with the search, can you elaborate?
Hi,
Apologies if I didn't made myself clear but I was able to filter my lookup properly now after fixing my logic. Thanks!
Please share the fix and accept it as the solution to help future readers.
Hi,
I just included the BU as part of my lookup. That made it more distinct.
eval BusinessUnit = "BU1" | lookup Application.csv ACCOUNT_CODE BusinessUnit OUTPUT Application
Thanks and Regards,