Splunk Search

How do I combine multiple lookups into one lookup?

Glasses
Builder

Lets say I have 3 lookups >>> a-list.csv, b-list.csv, c-list.csv and the lists only have 1 column header = Name
Alice is on a-list
Bob is on b-list
Charles is on c-list

There are lots of people on each list and the lists are dynamic and updated.
I have a request to create a Combined_Master Lookup (where C_M-list.csv = a-list.csv + b-list.csv + c-list.csv),
where the list contains NAME, FLAG fields such as

NAME,FLAG

Alice, a-list
Bob, b-list
Charles, c-list

So far I use the following query to build the C_M-list.csv, where there is a Name and Flag appended to each name (which indicate which list the person is from)
BUT I am wondering if there is a better way...

 

| inputlookup a-list.csv 
| eval FLAG = "a-list"
| inputlookup b-list.csv append=true
| eval FLAG = coalesce(FLAG, "b-list") 
| inputlookup c-list.csv append=true
| eval FLAG = coalesce(FLAG, "c-list")
|.... <rest of the query follows>....

 

My desired outcome is a M_C-list.csv

Alice,a-list

Bob,b-list

Charles,c-list

Any suggestions or improvements appreciated.
TY!

Labels (1)
1 Solution

jacobpevans
Motivator

Greetings @Glasses,

Try this:

           | inputlookup a-list.csv 
           | eval FLAG = "a-list"

| append [ | inputlookup b-list.csv
           | eval FLAG = "b-list" ]

| append [ | inputlookup c-list.csv
           | eval FLAG = "c-list" ]
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

0 Karma

jacobpevans
Motivator

Greetings @Glasses,

Try this:

           | inputlookup a-list.csv 
           | eval FLAG = "a-list"

| append [ | inputlookup b-list.csv
           | eval FLAG = "b-list" ]

| append [ | inputlookup c-list.csv
           | eval FLAG = "c-list" ]
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

Glasses
Builder

@jacobpevans NICE!!!

I tried something similar with subsearches and failed... but this seems like they way to go.

Thank you!

0 Karma

Glasses
Builder

Is there a way to use "foreach" to add the flag and append?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...