How do I merge columns from a CSV with an existing input lookup file?

[syedsalam]

Hi Team,

I have an input lookup file called windows.CSV and have another .CSV file which contains host, sourcetype, and source details.

How can we map these columns into the existing lookup file or merge two files into a single file?
Is it possible? Please suggest me.

Host, Sourcetype and Source

Regards,
Syed

[sundareshr]

Try this

| inputlookup new_windows_devices.csv | append [|inputlookup Windows.csv] | stats count by Hostname SourceType | fields - count

[sjohnson_splunk]

What is the common key field between the two files?

You could either do a lookup or a join command but you need a common key.

[sjohnson_splunk]

 | inputlookup windows.csv | lookup other.csv host | outputlookup merged.csv

This assumes that both are lookups (you didn't say that about the other.csv) if it's not then assuming it in var/run/splunk:

| inputcsv other.csv | lookup windows.csv | outputlookup merged.csv

[syedsalam]

Thanks John.

[syedsalam]

Hi,

Please suggest me, how to marge two files in to single file. Common key for both file is Hostname and SourceType.

i should get only column of Hostname and SourceType not any other columns.
The file name is available below.

| inputlookup new_windows_devices.csv | inputlookup Windows.csv

[syedsalam]

It's not working John.

[syedsalam]

Host field is common key in both file.

[muebel]

Hi syedsalam,

I believe you can accomplish this by utilizing the append=t functionality of inputlookup. i.e.

| inputlookup windows.csv | inputlookup other.csv append=t

Please let me know if this answers your question!

[syedsalam]

Thanks Muebel.

[syedsalam]

Hi Muebel,

My query is I have one look up file in Splunk for asset and another CSV file in My system. i want to Join both file in to single file.

is there any way to marge?