Filtering Lookup Results

[aquinojason]

Hi, 

Below is a result of a lookup command, how do I exclude the other information if I based in on BusinessUnit, For ex. I want to show BU2 only...  but there maybe cases that I need to show BU1 only. How can I filter my lookup result?

Application BusinessUnit DATE CALCMIPS

App1 App2 App3 App4

BU1 BU2 BU1 BU1

31DEC2020

20

My splunk query looks like

index=index1 sourcetype=source1 [ |inputlookup Application.csv where BusinessUnit = BU1 | return 1000 ACCOUNT_CODE] |  lookup Application.csv ACCOUNT_CODE OUTPUT Application BusinessUnit ApplicationRTO | table Application BusinessUnit DATE MVS_SYSTEM_ID CALCMIPS

Thanks and Regards,

[ericjorgensenjr]

What are you trying to accomplish with this bit:

[ |inputlookup Application.csv where BusinessUnit = BU1 | return 1000 ACCOUNT_CODE]

Because it looks to me like there is no field 'ACCOUNT_CODE' in the lookup, so this is going to return null.

Also, based on the way you displayed the output of the lookup are the Application and Business Unit multivalue?

Lastly, I think it's not fully clear what you're trying to accomplish with the search, can you elaborate?

[aquinojason]

Hi,

Apologies if I didn't made myself clear but I was able to filter my lookup properly now after fixing my logic. Thanks!

[richgalloway]

Please share the fix and accept it as the solution to help future readers.

[aquinojason · Accepted solution]

Hi,

I just included the BU as part of my lookup. That made it more distinct. 

eval BusinessUnit = "BU1" | lookup Application.csv ACCOUNT_CODE BusinessUnit OUTPUT Application

Thanks and Regards,