Splunk Search

How do I combine multiple lookups into one lookup?

Glasses
Builder

Lets say I have 3 lookups >>> a-list.csv, b-list.csv, c-list.csv and the lists only have 1 column header = Name
Alice is on a-list
Bob is on b-list
Charles is on c-list

There are lots of people on each list and the lists are dynamic and updated.
I have a request to create a Combined_Master Lookup (where C_M-list.csv = a-list.csv + b-list.csv + c-list.csv),
where the list contains NAME, FLAG fields such as

NAME,FLAG

Alice, a-list
Bob, b-list
Charles, c-list

So far I use the following query to build the C_M-list.csv, where there is a Name and Flag appended to each name (which indicate which list the person is from)
BUT I am wondering if there is a better way...

 

| inputlookup a-list.csv 
| eval FLAG = "a-list"
| inputlookup b-list.csv append=true
| eval FLAG = coalesce(FLAG, "b-list") 
| inputlookup c-list.csv append=true
| eval FLAG = coalesce(FLAG, "c-list")
|.... <rest of the query follows>....

 

My desired outcome is a M_C-list.csv

Alice,a-list

Bob,b-list

Charles,c-list

Any suggestions or improvements appreciated.
TY!

Labels (1)
1 Solution

jacobpevans
Motivator

Greetings @Glasses,

Try this:

           | inputlookup a-list.csv 
           | eval FLAG = "a-list"

| append [ | inputlookup b-list.csv
           | eval FLAG = "b-list" ]

| append [ | inputlookup c-list.csv
           | eval FLAG = "c-list" ]
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

0 Karma

jacobpevans
Motivator

Greetings @Glasses,

Try this:

           | inputlookup a-list.csv 
           | eval FLAG = "a-list"

| append [ | inputlookup b-list.csv
           | eval FLAG = "b-list" ]

| append [ | inputlookup c-list.csv
           | eval FLAG = "c-list" ]
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

Glasses
Builder

@jacobpevans NICE!!!

I tried something similar with subsearches and failed... but this seems like they way to go.

Thank you!

0 Karma

Glasses
Builder

Is there a way to use "foreach" to add the flag and append?

0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...