Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How do I simulate doing a left join or outer join ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Issue I am running into right now is I have a result set that I want to pull in threshold values that reside in a lookup CSV file. I am looking up based on a cluster title field, but ideally, what I want to happen is for every single cluster title in this lookup file to produce a row, even if there were no results in my actual search for that cluster. Is there a way I can do this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try like this (assuming your current search gives a results set with unique values of field cluster_title)
your current search giving result with fields cluster_title and others
| append [| inputlookup yourlookup.csv | table cluster_title ]
| stats values(*) as * by cluster_title
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try like this (assuming your current search gives a results set with unique values of field cluster_title)
your current search giving result with fields cluster_title and others
| append [| inputlookup yourlookup.csv | table cluster_title ]
| stats values(*) as * by cluster_title
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
works perfectly thank you so much!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you can try to use ...|appendpipe [stats count by clusterTitle |join max=0 clusterTitle [|inputlookup clusterTable.csv]|fields - count]|stats values(*) by clusterTitle
or something along those lines. Without knowing your actual syntax/data, that's the best I got.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Persistent Queue at TcpOut — One of Splunk's Most Practical Features
Build resilience for the agentic era: Join us at Splunk Go San Jose
Manage Edge Processor pipelines end to end with APIs
