Splunk Search

How do I combine multiple lookups into one lookup?

Glasses
Builder

Lets say I have 3 lookups >>> a-list.csv, b-list.csv, c-list.csv and the lists only have 1 column header = Name
Alice is on a-list
Bob is on b-list
Charles is on c-list

There are lots of people on each list and the lists are dynamic and updated.
I have a request to create a Combined_Master Lookup (where C_M-list.csv = a-list.csv + b-list.csv + c-list.csv),
where the list contains NAME, FLAG fields such as

NAME,FLAG

Alice, a-list
Bob, b-list
Charles, c-list

So far I use the following query to build the C_M-list.csv, where there is a Name and Flag appended to each name (which indicate which list the person is from)
BUT I am wondering if there is a better way...

 

| inputlookup a-list.csv 
| eval FLAG = "a-list"
| inputlookup b-list.csv append=true
| eval FLAG = coalesce(FLAG, "b-list") 
| inputlookup c-list.csv append=true
| eval FLAG = coalesce(FLAG, "c-list")
|.... <rest of the query follows>....

 

My desired outcome is a M_C-list.csv

Alice,a-list

Bob,b-list

Charles,c-list

Any suggestions or improvements appreciated.
TY!

Labels (1)
1 Solution

jacobpevans
Motivator

Greetings @Glasses,

Try this:

           | inputlookup a-list.csv 
           | eval FLAG = "a-list"

| append [ | inputlookup b-list.csv
           | eval FLAG = "b-list" ]

| append [ | inputlookup c-list.csv
           | eval FLAG = "c-list" ]
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

0 Karma

jacobpevans
Motivator

Greetings @Glasses,

Try this:

           | inputlookup a-list.csv 
           | eval FLAG = "a-list"

| append [ | inputlookup b-list.csv
           | eval FLAG = "b-list" ]

| append [ | inputlookup c-list.csv
           | eval FLAG = "c-list" ]
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

Glasses
Builder

@jacobpevans NICE!!!

I tried something similar with subsearches and failed... but this seems like they way to go.

Thank you!

0 Karma

Glasses
Builder

Is there a way to use "foreach" to add the flag and append?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...