Splunk Search

How to display search with multiple lookup? [SOLVED]

brad_
Engager

Hello
I have several lookups and I would like to display the details on a date range but I can't really do it
I have tried several combinations but either I display the last one or I display too many elements
As a bonus if I could have the total it would be cool

 

 

| inputlookup file1.csv
| append
    [| inputlookup file2.csv]
| append
    [| inputlookup file3.csv]
| append
    [| inputlookup file4.csv]
| append
    [| inputlookup file5.csv]
| append
    [| inputlookup file6.csv]
| sort - _time
| eval date = strftime(_time,"%Y-%m-%d")
| search date>2022-07-01 AND date<2022-07-04
| transpose 6
| sort - column
| search column=date OR column=count
| fields - column
| rename "row 1" as "name1", "row 2" as "name2", "row 3" as "name3", "row 4" as "name4", "row 5" as "name5", "row 6" as "name6"

 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookup file1.csv
| rename count as file1
| append
    [| inputlookup file2.csv
    | rename count as file2]
| append
    [| inputlookup file3.csv
    | rename count as file3]
| append
    [| inputlookup file4.csv
    | rename count as file4]
| append
    [| inputlookup file5.csv
    | rename count as file5]
| append
    [| inputlookup file6.csv
    | rename count as file6]
| stats values(*) as * by _time
| addtotals col=t row=f label=Total labelfield=_time

View solution in original post

brad_
Engager

Thx for your help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what you are trying to achieve - can you share some of the events (contents of csv files) and what your expected output would be

Having said that, you might want to use where command rather than search and use unformatted epoch times

| where _time > strptime("2022-07-01","%Y-%m-%d") AND _time < strptime("2022-07-04","%Y-%m-%d")
| transpose 6
| sort - column
| where column="_time" OR column="count"
0 Karma

brad_
Engager

Hello sorry to be unclear
all lookup have the same model see below

lookup.PNG
I need to display the items per line for each date of the range see the result file

Datefile1file2file3file4file5file
04/07/202223523536645545683
05/07/2022210300125120111513
06/07/2022185365116194682657
07/07/20221604303572692567127
08/07/202213549559834382108198
Total 9251825156297340272478


I hope that it is clearer
Thx

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookup file1.csv
| rename count as file1
| append
    [| inputlookup file2.csv
    | rename count as file2]
| append
    [| inputlookup file3.csv
    | rename count as file3]
| append
    [| inputlookup file4.csv
    | rename count as file4]
| append
    [| inputlookup file5.csv
    | rename count as file5]
| append
    [| inputlookup file6.csv
    | rename count as file6]
| stats values(*) as * by _time
| addtotals col=t row=f label=Total labelfield=_time
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...